Your data, isolated and encrypted
Security built in from day one. Your planning data stays private, protected, and under your control — and below is exactly how, including what we do not offer yet.
Tenant isolation
Every organisation's data lives in its own separate database, with its own credentials — not a shared table with a customer column, and not a shared database. When an account is deleted, that database is destroyed with it.
Encryption
Your Jira connection and each workspace's database credentials are encrypted at rest. All traffic between your browser, our servers, and Jira is encrypted in transit (HTTPS).
EU hosting
Database and application servers run in Frankfurt, Germany, so your data is stored in the European Union. AI copilot questions are processed by Anthropic in the US — see the privacy policy. We use Cloudflare for edge protection and DDoS mitigation.
Authentication
Passwords are stored only as a one-way hash, never in plain text. Sessions use cryptographically signed tokens with automatic expiration. New people choose their own password from a link we email them — nobody else ever sets or sees it. Each login has a role (Admin, Planner, or read-only Board) and sees only the portfolios it belongs to.
Minimal Jira access
Mermix connects via Atlassian's OAuth 2.0 with read + write scopes for your Jira issues, projects, sprints, and team — nothing more. Mermix asks for no Jira configuration access: it never creates fields, never changes screens or settings, and never touches Confluence or other Atlassian products. It changes only what you push — dates, assignee, estimate, sprint — and the dependency links you add, as the Jira account that connected it. Revoke access at any time from your Atlassian account settings; the connection drops immediately.
Data lifecycle
When you cancel your account, your data is retained for 30 days in case you change your mind. After that, your entire database is permanently deleted — no archives, no backups retained.
Common questions
Can other customers see my data?
No. Each organisation's data lives in its own separate database, with its own credentials — not a shared table with a customer column, and not a shared database. Our staff-facing tools show billing and service health only, never your planning data. Automated operations do reach your database, but solely to run the service you pay for: applying updates, enforcing your plan's data-retention window, counting usage against your plan, and deleting everything when you cancel.
Where exactly is my data stored?
All infrastructure — database, application servers, and backups — runs in Frankfurt, Germany. Traffic is proxied through Cloudflare's European edge network. All providers have signed Data Processing Agreements.
Are you GDPR compliant?
Yes. Data is hosted in the EU. We process only the data necessary for the service (Jira issues, team members, schedules). You can request full data deletion at any time, and our Data Processing Addendum is part of the Terms.
What happens if I cancel?
Your data is kept for 30 days in read-only mode. During this window you can reactivate your account instantly. After 30 days, all your data is permanently destroyed — allocations, worklogs, resources, and settings are irrecoverably deleted.
Do you have a DPA?
Yes. Our Data Processing Addendum is published and is part of the Terms on every plan, so there is nothing to request or sign separately. Questions: hello@mermix.io.
Do you support single sign-on (SSO) or hold a security certification?
Not yet. Sign-in is by email and password today; SAML single sign-on and certifications such as SOC 2 or ISO 27001 are not available. If your organisation needs either, tell us at hello@mermix.io — it shapes what we build next. Our own staff tools sit behind a separate sign-in with passkeys.
How do you handle AI copilot data?
AI copilot questions are sent to Anthropic with your planning context, in the US. Anthropic does not train on them and keeps them for up to 30 days. Your conversation is stored only in your browser — we do not keep chat logs on our servers. The changes the copilot proposes are kept, so you can reopen one by its ID.