Mio Security Center

Mio does not persistently store user messages or files. Message meta data is retained by Mio for future reconciliation across platforms. However the underlying messages and files are not permanently retained.

We store the following metadata: message identifier (ID), time stamp, platform assigned user IDs and/or channel IDs and associated identifiers. These are stored for the duration of the service contract, or until Mio is asked to destroy it via a hard delete.

Mio provides a proxy service for all files uploaded. When a file is either uploaded or requested by a connected platform or user, Mio will connect and authenticate to source platform and request the file. As the file is streamed, an outbound connection is made to the target platform or authenticated user, and the file is proxied to the recipient. Occasionally, a real time stream between the platforms is not possible. In this scenario, the file is requested and temporarily cached on the Mio server before the outbound connection is made. This two part transmission is still achieved through a single transaction, ensuring that the file is not retained by Mio outside the transfer session.

Mio takes the security of customer data extremely seriously and uses appropriate encryption strategies at every stage of its journey over our systems.

When data is in transit between connected platforms, Mio will connect to the API using TLS 1.2 or later, typically over the HTTPS protocol. For data at rest, data will be encrypted with a minimum industry standard of AES-256 encryption. Mio classifies all customer data, and as a minimum all our persistent storage has file storage encryption enabled. For higher classified data, we will perform additional encryption at the field level using an HSM backed AWS KMS service.

End-to-end encryption between platforms via Mio is not currently possible because Mio must be granted access to a plain text version of the chat message in order to translate it to the target platform. Unless chat platforms themselves choose to adopt a universal messaging format, Mio will require temporary access to the raw underlying message to be able to translate and apply the correct markup for the target.

Messages processed by Mio are never stored in an unencrypted format. Inbound events are immediately encrypted and only decrypted on demand when a transformative action is required. Translation typically occurs in milliseconds and in memory, greatly limiting exposure and potential attack vectors. Once translation and delivery is complete, the original and translated payloads are destroyed.

Mio is currently hosted exclusively in AWS US data centers. We utilize multi-zone redundancy to maximize availability and uptime. All customer data is currently retained in the US.

Mio utilizes multi-zone redundancy to maximize availability and uptime.

No, Mio is currently hosted in the US and we reserved the right to fail over to any AWS data center as part of our established business continuity plan.

To maximize Mio’s message delivery reliability, we’ve implemented a number of flow controls for messages entering and leaving the Mio subsystems. All message events received by Mio are delivered to front end servers distributed over multiple availability zones. For resilience, event payloads are immediately encrypted and placed into a fault tolerant FIFO queue for processing by the Mio multi-zone, distributed back end system. Mio has distributed its infrastructure and processing logic in such a way that processing and data persistence is highly resilient to individual node or cluster outages.

Mio’s ability to deal with partner outages requires an inbound and outbound replay strategy. Partners such as Slack have an automatic redelivery mechanism where, should a Mio resource be unavailable, they will resend the event multiple times until successful or they will otherwise give up. Mio’s outbound reliability is defined by our own queue replay strategy. Should a target partner platform be unavailable, Mio will retain the encrypted event in a queue, and will automatically attempt redelivery based on a time based replay strategy. Permanent failures are reported internally and monitored for further investigation and escalation where necessary.

Mio currently employs ThreatStack (https://www.threatstack.com/) to proactively monitor all of its production servers and infrastructure 24 hours a day. Agents are installed on every production instance and look for system anomalies and possible attempts of data exfiltration. A tested and proven escalation process is in place for Mio staff to react to any concerns that might be raised.

Mio retains customer data for the duration of their active account. The customer may request their data to be permanently deleted at any time (subject to Mio adhering to applicable state and federal laws).

Mio retains the following PII information for the purpose of normal operation of the service: First name, last name, and email address. Mio will also be provided an end user's current public IP address when accessing the m.io website.

Mio securely integrates with your messaging platforms and never asks for more permissions than necessary to make the app function as intended. Read more about each scope and why we need them in our Help Center for Microsoft Teams, Webex, and Slack.

For more information about Mio's security practices, visit our Help Center.