MIHOS Trust Center

A data protection officer asks the same questions every time: who is the controller, where the data sits, who else touches it, what the AI is allowed to do, and what happens when something goes wrong. This page answers them in public, and lists the documents we send on request.

At a glance

MuuM Sàrl, a Swiss company based in Nyon, operates MIHOS. For the data your teams put into the application, you are the controller and we act as your processor, on your documented instructions only.

Recordings, transcripts and analyses are stored in Switzerland, in the Zurich region, and the application runs on servers in Switzerland. Transcription and analysis are carried out in France. Practice sessions with an AI client are processed in the United States, under the Data Privacy Framework and Standard Contractual Clauses. Every other transfer, and the safeguard that covers it, is listed in annex 2 to our data processing agreement.

We do not use your content to train or improve any model, and at each provider that offers it, we switch off the use of our customers' content to improve its models. MIHOS infers no emotion and takes no decision about a person on its own. Speaker recognition by voice signature is off by default and is only offered with the explicit consent of the rep concerned. We do not claim certifications we have not obtained.

Documents on request

• Data processing agreement, with its three annexes: the description of each processing operation, the detailed list of sub-processors, and the technical and organisational measures.
• Detailed list of sub-processors: legal entity, data received, place of processing and transfer safeguard for each one.
• Technical and organisational measures in detail, including those still being deployed. We are setting a deployment date for each of them.
• Impact assessment pack, free of charge, once validated by our data protection officer: our own assessment of the product, and a template your organisation adapts to its context.
• Answers to your security or vendor questionnaire, once a year.
• Written answers to any specific question your data protection officer asks.

Who receives them

We send these documents to our customers and to organisations evaluating MIHOS. If you are evaluating, we first send a short confidentiality agreement, then the documents. We reply within two working days.

Use the form below, or write to privacy@mihos.ai.

Sub-processors by category

These are the categories of providers that process our customers' data, with the provider and the region for each. The detailed list, with legal entities and transfer safeguards, is annex 2 to our data processing agreement.

• Hosting and database: Infomaniak, Switzerland; Supabase on Amazon Web Services, Switzerland, Zurich region.
• Speech to text: Gladia, France; its sister company Gladia Inc. (United States) is among its sub-processors.
• Language models: OVHcloud, France.
• Practice sessions with an AI client: ElevenLabs, United States.
• Speaker separation or recognition, only where enabled: pyannoteAI, France.
• Transactional email: Mailjet, European Union.
• Error monitoring and product usage analytics: Sentry and PostHog (United States companies), data hosted in the European Union.
• Payments: Stripe (Ireland), with transfers to the United States.

Customers are told by email at least 30 days before a new sub-processor starts processing their data, and may object on reasonable data protection grounds.

Our commitments

• Consent first. Every recording is filed with a confirmation that every participant agreed, kept with the recording. Obtaining that consent is the customer's responsibility.
• Your content does not train our models, and we switch off its use to improve our providers' models wherever they offer that option.
• We infer no one's emotions or personality, and MIHOS takes no decision about a person on its own.
• Data stored in Switzerland, transcription and analysis in France, practice sessions in the United States, and every other transfer listed with its safeguard.
• At least 30 days' notice before any new sub-processor, with a right to object.
• Customers notified of a breach affecting their data within 48 hours at the latest.
• At the end of a contract, a written schedule for the export and deletion of your data, including at our sub-processors, and written confirmation of the deletion.
• We publish what is not yet in place: our measures annex lists the measures still being deployed, and we are setting a date for each.

Report a security issue

If you believe you have found a vulnerability or a data exposure in MIHOS, write to privacy@mihos.ai with the details. We acknowledge within two working days and keep you informed until it is resolved.