Security

• Calendar connection tokens are encrypted (AES-GCM) and are only ever handled by our servers, never sent to your browser.
• Calendar access is read-only, and you can disconnect at any time, which deletes the stored tokens.
• Our database uses access controls and row-level security, so each account can only reach its own data. Some data, like usage records, can't be reached from the browser at all.
• Admin access is limited to a small number of people and is checked on our servers for every request.
• All traffic to the service is encrypted in transit (HTTPS).
• Data is stored on managed cloud infrastructure from established providers.
• Our scheduled security checks run daily against the domains our customers add.

If you think you have found a security problem, please email info@mithos.co.uk with the details and steps to reproduce it. Please give us a reasonable time to fix it before telling anyone else, and don't access or change other people's data while testing. We will acknowledge your report and keep you updated.

We do not currently hold any security certifications.