Security isn't a feature. It's the foundation.

You're trusting Miki with candidate conversations, assessment data, and hiring decisions. Here's how we protect that trust.

AES-256-GCM at restTLS 1.3 in transitSOC 2 Type II in progressNo shared/public model training by default
Security snapshot

How Miki protects candidate and assessment data.

Data handlingEncrypted in transit and at rest
Access modelRole-based permissions with team-scoped access
AI usageNo shared or public model training by default
ProcurementSecurity questionnaires and review calls supported

Vulnerability reports: security@meetmiki.com

Core protections across the platform

Encryption, access controls, and disclosure practices built for teams handling sensitive candidate and assessment data.

Data protection

Encryption by default

  • Assessment data is encrypted at rest with AES-256-GCM.
  • Data in transit is protected with TLS 1.3.
  • Sensitive integration credentials are encrypted before storage.

Access control

Role-based permissions with team scoping

  • Access is authenticated before teams can reach protected product surfaces.
  • Permissions are role-based across owner, admin, manager, and viewer access.
  • Application access is scoped so one team cannot browse another team’s data.

Integrations

Safeguards around APIs and webhooks

  • Sensitive keys and credentials are stored hashed or encrypted instead of plaintext.
  • Webhook signatures are verified where supported.
  • Rate limits help reduce abuse across public and API endpoints.

Monitoring

Visibility when something looks wrong

  • Operational and security-relevant failures are monitored with alerting.
  • Security reports have a dedicated disclosure path at security@meetmiki.com.
  • We support security questionnaires and live review calls with your team.

Your data stays yours

Security controls matter. So does what we do with the data after it enters the product.

No shared or public model training by default

By default, customer workspace content is not used to train shared or public AI models.

Retention should have limits

We support cleanup and deletion workflows so candidate data does not need to sit around indefinitely.

You keep control of the record

Teams can export assessment data and request deletion of candidate records when needed.

Assessment integrity is a security problem

When AI administers an assessment, it can also help challenge suspicious answers while the conversation is still live — not just after the fact.

Active Integrity Probing™ is designed to help flag AI-assisted responses, live coaching, copy-paste behavior, and response-pattern anomalies during the assessment itself.

It is meant to strengthen reviewer judgment, not replace it. Signals surface in context so hiring teams can investigate with a human in the loop.

Patent PendingIncluded on all plans
Signals surfaced for review
01

Conversational probes

Callback, pivot, paraphrase, and contradiction checks can pressure-test ownership of an answer in real time.

02

Response timing shifts

Timing anomalies are reviewed against the candidate’s own baseline, not a generic benchmark.

03

Linguistic pattern changes

Sudden shifts in wording, specificity, or register can surface for review.

04

Integrity confidence readout

Signals are summarized into reviewer context so hiring teams can investigate instead of guessing.

Review postureHuman in the loop

Compliance and certifications

SOC 2 remains in progress. Completed controls and current commitments are listed below.

ItemStatus
SOC 2 Type IIIn progress — roadmap committed
GDPRCompliant data handling + deletion support
Data encryption at restAES-256-GCM
Data encryption in transitTLS 1.3
Access controlsRole-based permissions + team scoping
Responsible disclosuresecurity@meetmiki.com
Procurement support

Questions about security?

We're happy to walk through architecture, answer a security questionnaire, or join a call with your security team.