Security

Last updated January 2025

Our Security Philosophy

Security is fundamental to Mitra's design. We follow the principle of "security by default" — your data is protected without requiring you to configure anything. This page explains the security measures we employ.

Local Data Protection

Encrypted Local Storage

Your local data is stored in an encrypted SQLite database using industry-standard encryption:

  • Encryption algorithm: AES-256-GCM
  • Key derivation: Your master password is processed through Argon2id with secure parameters to derive the encryption key
  • At-rest encryption: The entire database file is encrypted

Master Password

Your master password is the key to your data. We implement several protections:

  • Your master password never leaves your device
  • We use memory-hard key derivation to resist brute-force attacks
  • The derived key is stored only in memory while the app is running
  • You can configure auto-lock after a period of inactivity

Cloud Sync Security

Encryption

When you enable cloud sync, your data is protected with multiple layers of encryption:

  • Data is encrypted locally on your device before being sent to our servers
  • All synced data is encrypted at rest on our servers
  • All communication is encrypted in transit via TLS 1.3

Transport Security

  • All API communication uses TLS 1.3
  • Certificate pinning in the desktop app prevents MITM attacks
  • HSTS headers enforce HTTPS connections

Authentication

  • Password hashing: Account passwords are hashed with Argon2id using secure parameters
  • Session tokens: Short-lived JWTs with secure refresh token rotation
  • OAuth integrations: Calendar connections use OAuth 2.0 with minimal scopes

Infrastructure Security

Server Security

  • Servers hosted on reputable cloud providers with SOC 2 compliance
  • Network isolation and firewall rules limit access
  • Regular security updates and patch management
  • No direct SSH access — all management through secure bastion hosts

Database Security

  • Encrypted at rest using provider-managed keys
  • Regular automated backups (also encrypted)
  • Point-in-time recovery capability
  • Access limited to application services only

Monitoring and Incident Response

  • 24/7 monitoring for anomalies and potential security incidents
  • Automated alerting for suspicious activities
  • Documented incident response procedures
  • Regular security assessments

Application Security

Secure Development

  • Security-focused code reviews for all changes
  • Dependency scanning for known vulnerabilities
  • Static analysis tools to catch common security issues
  • Regular updates to address security patches

Update Security

  • All app updates are cryptographically signed
  • Update signatures are verified before installation
  • Updates are delivered over HTTPS with certificate validation

Security Best Practices for Users

To maximize your security:

  • Use a strong master password: At least 12 characters with a mix of letters, numbers, and symbols. Consider using a passphrase.
  • Store your master password securely: Use a password manager or write it down and store it in a safe place. We cannot recover your data if you forget it.
  • Enable auto-lock: Configure the app to lock after inactivity if you share your computer.
  • Keep the app updated: Enable automatic updates to receive security patches promptly.
  • Use a unique account password:If you create a cloud account, use a password you don't use elsewhere.

Responsible Disclosure

We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly:

  • Email us at [email protected]
  • Provide sufficient detail to reproduce the issue
  • Give us reasonable time to address the issue before public disclosure

We appreciate security researchers who help keep Mitra secure and will acknowledge valid reports.

Questions

If you have questions about our security practices, please contact us at [email protected].