Compliance & data security

This page describes how we protect data in the Mira HR service and on this website.

All traffic to the website, the Mira HR app and the API is encrypted in transit over HTTPS.

User accounts are protected by the following measures:

• Passwords are stored only as salted one-way hashes (Argon2id).
• Optional two-factor authentication with authenticator apps (TOTP) and one-time backup codes. Two-factor secrets are encrypted in storage.
• Automatic temporary lockout after repeated failed sign-in attempts, and rate limiting of sign-in requests.
• Short-lived access tokens (ten minutes) that are renewed through a session; signing out revokes the session on our servers.

Access within a company is controlled by roles and denied by default: users see only the sections and records their role allows. The company owner, and users the owner authorizes, manage roles and access.

Access by Mira HR staff through our administration tools is limited by role. When our support team needs to see what a user sees, that access is read-only, limited in time and recorded in our internal audit log.

Administrative actions by our staff are recorded in the same log, without customers' personal data.

Uploaded documents are stored privately and are served only after a permission check.

When an employee is removed from a company, their personal records in that company, such as their profile, access rights, calendar entries, requests and tasks, are deleted. Payroll history, documents, asset records and shared communications, such as chat messages, are kept for the employer's records.

Google Analytics loads only after you accept it in the cookie banner; until then the website makes no requests to Google. The early access form is protected against spam with rate limits and a bot trap, and we store only what is needed to answer a request.

Mira HR is built for the requirements of the UAE and Egypt:

• WPS-ready SIF salary files for the UAE Wage Protection System.
• Egyptian income tax and social insurance calculations.
• Recording of the privacy notice version with each demo request.
• Designed to support obligations under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and Egyptian Law No. 151 of 2020 on the Protection of Personal Data.

If you believe you have found a security vulnerability in Mira HR, please let us know so that we can investigate it promptly.

Please report it through the demo request form on this website.