Security Overview

This page describes security controls implemented in the current Mirentra platform as verified in the repository and deployment configuration. It is not a certification statement, audit report, or guarantee of security. Mirentra does not claim SOC 2, ISO 27001, or similar third-party certification unless separately documented in an executed agreement. Last updated: 7 September 2026.

Authentication

User access to the platform is gated by Firebase Authentication. Supported sign-in methods in the current deployment include email/password and Google sign-in. Tax Director and Admin roles require authenticator-app (TOTP) multi-factor enrollment before workspace access. Users are responsible for protecting their credentials and reporting suspected compromise.

Encryption and data protection

The application is served over HTTPS via Firebase Hosting (encryption in transit). Customer data stored in Google Cloud / Firebase services (including Cloud Firestore and Cloud Storage) is protected by Google Cloud’s default encryption at rest. Hosting configuration includes Strict-Transport-Security (HSTS), X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, and a Content-Security-Policy appropriate to the application.

Database access and organization tenancy

Customer workspace data is stored in Cloud Firestore. Firestore security rules enforce authenticated access and scope reads and writes to workspace owners and invited team members. User profile documents restrict role escalation after account creation. Default deny rules block access to unspecified collections.

Role-based permissions

Role-based access control (RBAC) is enforced in the product UI and in write paths. Capability matrices cover data import, calculation approval, exports, user management, and advisor seats for roles including Tax Analyst, Tax Manager, Tax Director, Admin, and Advisor. Firestore security rules are the authoritative control for data access: they scope workspace membership, prevent client-side role escalation after profile creation, and block public self-assignment of Tax Director. UI permission checks are not a substitute for those rules.

Audit logging

The application maintains an in-product audit log recording significant workspace events such as calculations, safe harbour elections, data imports, exports, approvals, and administrative actions. Audit entries are stored with workspace data and can be exported for review. Legal acceptance events are recorded separately with server timestamps when users accept platform terms.

Limitations and reporting

No method of transmission or storage is completely secure. This overview does not claim independent penetration-test results, specific recovery-time objectives, or third-party certifications unless separately verified and documented in an executed agreement. Security concerns or suspected incidents may be reported to ibrahimbandak@mirentra.com.