How We Protect Your Data

Your data is processed by simiriki and the third-party services below. This registry supports applicable processor/subprocessor disclosure obligations and stays in lockstep with the machine-readable schema embedded on this page.

Full contractual terms in our Data Processing Agreement.

These are TARGETS our compliance program is built toward — not active certifications. We disclose this honestly: simiriki does not hold these certifications today. Audit dates are revenue-triggered and available on request.

The free scan requests only least-privilege, read-only configuration scopes — never the content of your mail, calendar, files, or contacts. Each permission maps to the detection rules it powers.

In the event of a security incident:

1. Notification without undue delay and within 72 hours after simiriki becomes aware, unless the executed DPA sets a stricter period
2. Notification under applicable law: current Mexican LFPDPPP Article 19 requires immediate notice to data subjects for significant impact; counsel determines any authority notice. GDPR’s 72-hour authority rule applies only where GDPR applies.
3. Synthetic probes, process and backup health checks, structured host logs, and manual security reporting
4. Incident logged in tamper-evident audit ledger
5. Post-incident report within 5 business days

simiriki operates as a 100% cloud-native, paperless service. Our infrastructure choices prioritize energy efficiency:

• Serverless compute — scales to zero when idle, no always-on servers consuming energy
• Optimized polling — connector intervals set to 15–60 minutes (not continuous) to reduce API calls and compute cycles
• Aggressive data cleanup — automated monthly retention policies prevent database bloat
• Zero paper — all audit reports, contracts, and communications are digital
• Remote-first — no physical offices, no commute emissions