Security

The security of our clients' data is at the heart of Miravela AI. Here are the technical and organisational measures we maintain.

Encryption

All data is encrypted at rest (AES-256) and in transit (TLS).

Per-client isolation

Every client is strictly isolated from the others at the database level (row-level security). Files are stored in private buckets, served only through short-lived signed links. No client can access another client's work.

Hosting in the European Union

Data and files are hosted in the EU (Supabase, Paris region). The application runs on Vercel. See the sub-processor list.

Access management

Least-privilege access, strong authentication (passkeys and Google sign-in) for the admin workspace, and time-limited magic-link access for clients.

Backups

Data is backed up regularly, with tested restoration.

Human review

Nothing is delivered automatically: every selection goes through a human review before it reaches the client.

No-training commitment

Miravela never trains an AI model on your briefs, references, logos, products or generated visuals, and never uses them to improve the platform or to serve another client (Terms, article 20). To generate, your content is sent to the provider that runs the model, for the time of the generation; each provider's own policy on training is shown on the sub-processor list.

Asset provenance

Every visual produced on the platform is traceable: model, prompt, generation date and cost are stored with the asset. Client deliveries carry a transparency notice stating the content is AI-generated.

Audit log

Sensitive operations (generations, deletions, exports, shares, API access) are recorded in a timestamped audit log available to the administrator.

In case of an incident

In the event of a data breach, we notify affected clients without undue delay (and within 48h at the latest), in line with the GDPR.

Contact us

For any security question, or to request our Data Processing Agreement (DPA): info@miravela.ai.