Every query limited to the firm
Every read is automatically limited to the signed-in person's firm. A query that cannot be safely limited is rejected. It never runs without the filter.
FIRM ISOLATION
Each firm's data is separated at the level of every query.
Many firms use the system, and none can see another's data. The separation does not depend on a developer's care on each screen. It is enforced by the database access layer.
EVERY QUERYEVERY WRITEEVERY TABLE
References to another firm's records are rejected
A write that points to a client, matter or person from another firm does not go through.
Structure check at every start
The system checks that every data table is assigned to a firm. A table without that assignment stops the application.
ACCESS CONTROL
Each person sees what their role allows.
Permissions are granted by the firm, not by the vendor. Access is set by two independent settings: module permissions and matter scope.
ROLESMODULESMATTERS
Edit, view or no access.
- Set separately for the dashboard, clients, matters, finance and settings.
- Role templates: partner, lawyer, trainee, assistant, secretariat.
- No one can grant others a higher level than their own.
All, own, team or selected.
- Matter team: lead, relationship partner, advocate or legal adviser, trainee, assistant.
- A single matter can be shared with a named account.
- The scope also applies to the Mivi assistant: it sees only what the user sees.
SIGN-IN AND SESSION
A password is not enough. That is why there is a second factor.
A lawyer's account opens data covered by professional secrecy, so sign-in is protected on several levels at once.
PASSWORDSECOND FACTORSESSION
Passwords stored with Argon2id
At least 10 characters. The system rejects the most common passwords and passwords built from the login or the firm's name.
Two-factor sign-in
A one-time code from an authenticator app, each valid only once. The firm owner can require it from everyone.
Protection against password guessing
Attempt limits per address and per account. The account holder is notified by email when the account is locked. The system's responses never reveal whether an account exists.
One session per account
A new sign-in ends the previous session. After inactivity the system signs you out after 30 minutes or after the time set by the firm, at most 4 hours. Changing the password ends all sessions.
AUDIT TRAIL
Every change has an author, a date and an address.
When you need to know who changed data and when, the answer is in the log, not in the team's memory.
WHOWHENWHAT
Activity log
Data changes, sign-ins, team and access changes, deadline and invoice operations, and security settings. Each entry has an author, IP address and time. The firm owner sets the retention period between 30 and 180 days.
Deletion register
A deleted record is saved in full and kept for 180 days.
A second person approves preclusive deadlines
A preclusive deadline entered by one person must be approved by another. Changing the date withdraws the approval.
BROWSER AND FILES
Safeguards also work on the browser side.
An attack does not have to target the server. That is why the system limits what the browser may run and checks every uploaded file.
CONNECTIONFORMSFILES
Encrypted connection
Traffic goes over HTTPS only, with an HSTS header that forbids the browser from connecting without encryption.
Protection of forms and page content
Every form carries a token checked before any data is read. A strict content security policy blocks injected scripts, and the system cannot be embedded in another site.
Files checked by content
A file's type is verified by its content, not its extension. Files get random names, sit in the firm's folder outside the public part of the server and are served only after a permission check.
KSeF keys encrypted
The KSeF token and the offline certificate key are stored encrypted (AES-256-GCM), with the key kept outside the database.
THE DATA BELONGS TO THE FIRM
You take your data at any time.
The firm is never held hostage by the system. A full export needs no request to us, and the rules for deleting data after the contract ends are fixed.
EXPORTDELETIONMIVI
A full export with one button.
- A ZIP archive: all data as CSV files plus all of the firm's files.
- The firm owner runs the export, without the vendor's involvement.
- After the contract ends: 30 days to export, deletion of data within 60 days.
Off by default.
- The firm owner switches it on, then each person separately.
- The language model runs in the European Union; data is not used to train the model.
- Mivi receives no names, PESEL or NIP numbers, addresses, case reference numbers or amounts.