Security and privacy

Security underpins everything we build at Myra. This page explains the controls we run today, what our infrastructure providers give us, and the things you as an admin can configure yourself. It is maintained by the Myra team and is not an independent certification.

Infrastructure and hosting

Myra runs on managed cloud infrastructure provided by Supabase (on AWS) and Cloudflare. Our application layer runs on Cloudflare Workers at the edge, and our database, auth, and file storage run on Supabase.

Provider certifications: Our upstream providers (AWS, Cloudflare, Supabase) maintain their own SOC 2 Type II and ISO 27001 programs. Myra itself is not SOC 2 or ISO 27001 certified; we inherit the platform controls from these providers.
Data residency: Your database lives in the region assigned to your Myra workspace. If you need a specific region for compliance reasons, contact us before onboarding.
Network: All traffic is served through Cloudflare, which provides TLS termination, DDoS mitigation, and a Web Application Firewall in front of the app.

Data protection and encryption

In transit: All traffic between your browser and Myra is encrypted using TLS (HTTPS). HSTS is enabled on our published domains.
At rest: Database, file storage, and backups are encrypted at rest by our infrastructure providers using AES-256. Key management is handled by the provider.
Secrets: API keys and third-party credentials you add (Stripe, telephony providers, SMTP, etc.) are stored as encrypted secrets and are only decrypted at the point of use on the server.

Authentication and access control

Passwords: Passwords are hashed by our auth provider; they are never stored in plaintext and are not visible to Myra staff.
Multi-factor authentication (MFA): Any user can enable TOTP-based MFA (Google Authenticator, 1Password, Authy, etc.) from My Profile > Security. We strongly recommend it for every admin.
Google sign-in: Users can sign in with Google in addition to email + password.
Role-based access: Client members are assigned granular per-feature permissions (view / edit / none). Business owners can create custom permission presets and restrict what each teammate can see or change.
Client isolation: Each client's data (contacts, calls, messages, files, invoices) is scoped by workspace. Users can only access data in workspaces they have been explicitly added to. This is enforced at the database layer with row-level security, not just in the UI.
Session management: You can sign out of all devices from My Profile > Security.

Privacy and your data

Your data is yours. You can export your contacts, notes, and messages at any time from the Contacts and Settings screens.
We do not sell your data, and we do not use your customer data to train third-party AI models.
AI processing: When you use AI features (assistants, summaries, automations), the relevant prompt and context are sent to the AI provider we use to fulfil that request. Providers process this data to return a response and, per their contracts with us, do not retain it for model training.
Deletion: You can delete individual contacts from the Contacts screen, and you can request full workspace deletion by contacting support. Backups roll off on our provider's standard retention schedule.
GDPR / UK GDPR: For customer data you store in Myra, we act as your processor. A Data Processing Agreement is available on request; see the DPA link in the footer.

Payments and financial data

Card details for subscriptions, top-ups, and customer invoices are handled by Stripe. Myra never sees or stores full card numbers.
Balances and invoices (business wallet, telephony balance, client invoices) are stored in your workspace and visible only to authorised admins.

Telephony and messaging

Call recordings, transcripts, and SMS/WhatsApp messages are stored inside your workspace and are subject to the same access controls as the rest of your CRM data.
Compliance for call recording, marketing SMS, WhatsApp opt-in, and A2P registration is a shared responsibility: Myra provides the tooling (stop-word handling, opt-out links, A2P submission), and you are responsible for how you use it in your jurisdiction.

Monitoring and incident response

Application logs and error tracking run on our infrastructure so we can investigate issues without exposing raw errors to end users.
Audit trail: Key changes inside a workspace (logins, permission changes, client archival, integration connects) are logged and visible to business admins.
Incident response: If we become aware of an incident that affects your data, we will notify affected workspace admins by email as soon as we have confirmed facts, and follow up with a written summary.
Vulnerability disclosure: If you believe you have found a security issue in Myra, please email contact@heymyra.ai with details and a proof of concept. Please do not test against other customers' workspaces.

Business continuity

Backups of the database are handled by Supabase using their point-in-time recovery feature.
Uptime: Our SLA for paid plans is published on the SLA page.

What you should do as an admin

Turn on MFA for yourself and require it of every teammate with access to customer data.
Review your users list regularly and remove ex-staff or unused accounts.
Use least-privilege presets — give teammates only the features they need to do their job.
Rotate integration keys if you suspect any credential (Stripe, telephony providers, SMTP, Google) has been exposed.
Educate your team — Myra staff will never ask for your password.

FAQs

Is Myra SOC 2 or ISO 27001 certified? No. Our infrastructure providers (AWS, Cloudflare, Supabase) hold those certifications; Myra itself does not currently hold an independent SOC 2 or ISO 27001 attestation.

Where is my data stored? Inside the cloud region assigned to your workspace by our infrastructure provider. If you have a specific residency requirement, contact us before onboarding.

Can Myra staff see my data? A small number of engineers can access production data when strictly necessary to support you or fix a bug. All such access is logged. We do not read your data for any other purpose.

Do you sell data or train AI models on it? No. Your data is not sold and is not used to train third-party AI models.