Where the data is
The application, database, files and backups are in the European Union, and backups are kept in a separate store, apart from the server and from the files. We do not transfer entrusted data outside the European Economic Area.
DOCUMENTS / SECURITY PACK · MWS-LEG-007
Mivare Sites security pack. What we protect and how, with no frills.
Answers to the questions a company or its adviser asks before choosing an application: where the data is, who has access to it, how it is protected and what happens in the event of a failure.
YOU ARE IN THE RIGHT PLACE
Security pack in six sentences.
This page summarises the ‘Security pack’ document for Mivare Sites. Below you will find the essentials in plain language. The binding full text is published in one place: the Mivare Group document library.
Version in force: 1.0 · 30 October 2026
Open the full text and PDFDOCUMENT MWS-LEG-007
Each company's data kept separate
A company account is logically separated from the others at application and database level, and files are made available only through the application, after permissions are checked. We do not combine data, do not sell it and do not use it to train artificial intelligence models.
Sign-in and access
Passwords are stored solely as an Argon2id hash, two-factor authentication (TOTP) is available to every user, and the administrator may require it for everyone. Sign-in attempts are limited, and the account is locked after failed attempts.
Encryption and files
Connections are encrypted (TLS), the application encrypts files before they are written and scans every uploaded file with antivirus software. Backups are encrypted with a key kept off the server. Encryption of the database on disk is only planned, and we say so plainly.
Backups and continuity
We back up the database every hour and keep those backups for 7 days, make a full backup once a day and keep it for 3 days, files have a continuous backup, and we test data restores periodically. Planned interruptions longer than 15 minutes are announced at least 48 hours in advance.
Incidents and audit
We notify the account administrator of a personal data breach no later than 48 hours after becoming aware of it. We answer questions about safeguards within 14 days, and the company or an independent auditor may carry out an audit under the DPA, no more than once every 12 months.
WHERE TO FIND THE FULL DOCUMENT
All our legal documents are published at Mivare Group.
Mivare Sites is built by Mivare Labs, a brand of Mivare Group. We keep the terms of service, privacy and cookie policies, data processing agreements, payment terms and legal information for all our brands and products in a single library, at permanent addresses, as web pages and PDF files.
Go to the Security pack at Mivare GroupONE LIBRARYONE SOURCE
One source
The same current text applies to every brand and every product. There are no versions that drift apart between websites.
Always the current versionWeb page and PDF
Read the document in your browser or download it as a PDF to keep for your own records.
To read and to keepOne company
MIVARE GROUP PROSTA SPÓŁKA AKCYJNA · Registered office: 22-440 Krasnobród · Registry court: Sąd Rejonowy Lublin-Wschód w Lublinie z siedzibą w Świdniku, VI Wydział Gospodarczy KRS · KRS 0001268091 · NIP 9223092251 · REGON 545767254 · Share capital: PLN 1,000. The brands are trading names of a single entity.
You know who you are contracting with