View Miro Trust center's compliance certifications, resources and subprocessors

Miro Trust Center

Welcome to Miro's Trust Center, where our commitment to data privacy and security is central to our operations. [Miro](https://miro.com/index/) provides a AI powered innovation workspace that enables distributed teams of any size to dream, design, and build the future together.

This Trust Center offers detailed insights into our security practices, including the specific controls and policies implemented by our teams. You can explore our compliance standards, request access to comprehensive security documentation, and gain a clear understanding of how we safeguard your data.

Additionally, we invite you to subscribe for updates to stay informed about the latest advancements in our security and compliance initiatives.

Certifications

This trust portal is being prepared and will be available soon.

Trust portal coming soon

Controls

Trusted by

Documentation

Documents will appear here once they are published.

By requesting access, you agree to {companyName}'s <privacyPolicy>Privacy Policy</privacyPolicy>. This trust center is powered by <wolfiaPrivacy>Wolfia</wolfiaPrivacy>.

Fill out this form to request access. We'll review your request and get back to you shortly.

Error submitting request

We'll review your request to access our private documents and get back to you shortly.

Your access request has been successfully submitted.

Access request submitted

Request access to documentation

We will process your questionnaire and email {email} when it's ready.

Questionnaire submitted

Submit a questionnaire

Subprocessors

By signing up for email notifications, you agree to {companyName}'s <privacyPolicy>Privacy Policy</privacyPolicy>. Notifications are powered by <wolfiaPrivacy>Wolfia</wolfiaPrivacy>.

Receive email notifications when {companyName} publishes important updates to their Trust Center.

You will now receive email notifications when {companyName} publishes important updates.

Subscribed!

Subscribe to updates

Updates

International standard for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS). ISO 42001 provides a framework for responsible AI development, deployment, and monitoring including bias mitigation, transparency, and accountability measures. Organizations demonstrate governance over AI lifecycle risks and commitment to ethical AI practices through certified management systems.

Artificial Intelligence Management System

Premier international standard for information security management systems requiring risk-based approach to protecting information assets. ISO 27001 certification involves rigorous third-party audit of policies, procedures, and controls across 114 requirements in 14 domains. Organizations demonstrate systematic approach to managing sensitive information ensuring confidentiality, integrity, and availability.

Information Security Management System

Comprehensive audit examining both design and operating effectiveness of controls over a period of time, typically 6-12 months. SOC 2 Type II reports provide detailed testing of security, availability, processing integrity, confidentiality, and privacy controls in operation. This rigorous assessment offers stakeholders highest assurance that controls consistently protect data and systems as designed.

System and Organization Controls Type II

The EU's comprehensive data protection law that sets strict guidelines for collecting and processing personal information. GDPR compliance demonstrates accountability in data handling, requiring organizations to implement privacy by design, maintain detailed records, and respect individual rights. Organizations must ensure lawful basis for processing, enable data portability, and provide breach notifications within 72 hours.

General Data Protection Regulation

California's landmark privacy law granting consumers rights over their personal information collected by businesses. CCPA compliance requires transparency in data collection, consumer rights fulfillment processes, and security measures protecting personal information. Organizations must enable data access, deletion, and opt-out rights while maintaining detailed records of data processing activities.

California Consumer Privacy Act

UK government-backed certification demonstrating protection against common cyber threats. Cyber Essentials certification verifies implementation of fundamental security controls including boundary firewalls, secure configuration, access control, malware protection, and security update management.

UK Cyber Essentials

Trusted Information Security Assessment Exchange Level 2 certification for automotive industry partners. TISAX AL2 enables secure information exchange with high protection needs including confidential data, prototype information, and development specifications. Based on VDA ISA (Information Security Assessment) and ISO 27001 standards.

TISAX Assessment Level 2

Microsoft's comprehensive supplier assurance program validating security and privacy practices. The SSPA certification demonstrates compliance with Microsoft's stringent requirements for data protection, security controls, privacy management, incident response, and ongoing risk assessment for suppliers handling Microsoft data.

Microsoft Supplier Security & Privacy Assurance

Legal mechanism enabling compliant personal data transfers from the European Union to certified US organizations. Participating companies self-certify adherence to privacy principles including notice, choice, accountability, and data security enforced by the FTC. This framework replaces Privacy Shield, providing renewed legal basis for transatlantic data flows essential for digital commerce.

EU-U.S. Data Privacy Framework

Accenture

Deloitte

Ulta Beauty

CVS Health

PepsiCo

Danaher Corporation

Ubisoft

Slalom

Comcast

Chase

DocuSign

Microsoft

ServiceNow

Zendesk

ISO/IEC 42001:2023 Certificate

ISO/IEC 27001 Certificate

SOC 2 Type II Report 2025-2026

SOC 3 System and Organization Controls Report 2025-2026

Miro Penetration Test Summary 2025-2026

Miro has officially released its latest SOC 2 Type II report for the period of **December 1, 2024, to December 31, 2025**.

This year’s report validates the security of our evolution into an **AI Innovation Workspace**. It confirms that our internal controls—including those governing our AI features, modern infrastructure, and automated governance—meet the highest industry standards for security, availability, and confidentiality.

SOC 2 Type II reports remain valid for 12 months from the certification date. Miro remains committed to the continuous monitoring and annual external validation of our environment by AICPA-accredited auditors.

**Access the Report:** The full report is available for download under **Documentation** or at [**trust.miro.com**](http://trust.miro.com) (requires NDA).

Miro 2026 SOC 2 Type II Report Now Available

See Miro's press release regarding ISO/IEC 42001

Miro among the first to attain AI management systems standard ISO 42001

Miro has just released its SOC2 Type II report for the period of January 1st, 2024 to December 31st, 2024. SOC2 Type II reports are typically valid for at least 12 months after the certification date, and Miro will continue to validate its controls internally and externally with 3rd party AICPA accredited auditors.

See the full report under Resources or trust.miro.com with NDA.

Updated Miro SOC2 Type II Report for 2025

Miro is now a member organization of the [Data Privacy Framework (DPF) program](https://www.dataprivacyframework.gov/list).  This participation allows personal data to freely flow to the United States from the European Union, United Kingdom, and Switzerland in accordance with the terms of Miro’s Customer Data Processing Addendum (DPA) without the need to enter into additional transfer terms such as the Standard Contractual Clauses (SCCs).  

The EU-US DPF restores an important mechanism for the cross-border transfer of personal data and was developed to further facilitate transatlantic commerce.  To participate in the DPF program, Miro completed its self-certification to the International Trade Administration of the US Department of Commerce via the Department's DPF program website and publicly committed itself as an organization to comply with the DPF Principles of notice, choice, security, data integrity and purpose limitation, access, recourse and enforcement, and accountability for onward transfers. Miro’s participation in the DPF program reinforces our dedication to GDPR-driven privacy and data protection principles.

You may find Miro’s listing on the DPF website [here](https://www.dataprivacyframework.gov/participant/4980) and refer to the details outlined in our updated [Privacy Policy’s](https://miro.com/legal/privacy-policy/) Section 10 for International Transfers.

Miro Joins the EU-US Data Privacy Framework

Whitepaper with details describing how [Miro's Enterprise Guard](https://trust.miro.com/resources?s=7qbxjyqwcjtrx67rb2uny\&name=enterprise-guard-data-security-architecture-sheet) works

Miro Trust Center Trust Center