Security and compliance

Short answers on certifications, data location, secrets, and retention.

SOC 2 Type I is complete, and the report is available to customers and prospects under NDA. SOC 2 Type II is in progress, with the observation window underway. See Trust.

MIOSA runs HIPAA-compliant infrastructure for healthcare workloads, and business associate agreements (BAAs) are available for Enterprise customers. See Trust.

In United States data centers we provision, network, and manage directly; MIOSA is not a reseller of a hyperscaler. The three live regions are all in the US, and a resource cannot move between them after creation. See Regions and Trust.

Values are encrypted with ChaCha20-Poly1305. Sandboxes see an opaque miosa-tok-<hex> placeholder that is swapped at egress, so no one - including MIOSA engineers - can re-read a stored value. See Secrets.

Egress audit events are retained 90 days. Usage and credit records are kept separately. There is no published zero-retention mode. See Data retention.

No. There are no pk_* publishable keys: API keys are server-only. Browser and embed access uses short-lived scoped tokens instead (mp_ preview, ms_ share, and browser tokens). See API keys and Browser tokens.