Miro
Work management · miro.com · last read 2026-11-09
At a glance
- Is Miro GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Miro itself publishes, each answer linked to its source and the date we read it.
- Does Miro have a data processing agreement (DPA)?
- Yes. Miro publishes a data processing agreement at miro.com. It gives 10 days' notice before a new subprocessor is added. It promises breach notification "without undue delay", with no number of hours. Source and date
- Which version of the Miro DPA is current?
- On 2026-11-09, Miro's DPA at miro.com printed “Effective Date: September 17, 2024”. Source and date
- Does Miro have a SOC 2 report?
- Miro says a SOC 2 Type 2 report is available on request. In Miro's words: “Yes. Miro maintains SOC 2 Type II compliance. You can review this in the compliance section of this trust center.” Miro also publishes a SOC 3 report. We read this on 2026-10-26. Source and date
- Is Miro ISO 27001 certified?
- Miro states ISO/IEC 27001 certification (2022 edition, as Miro names it), and its own page links to the certificate. In Miro's words: “Yes. Miro is ISO 27001 certified. You can review this certification in the compliance section of this trust center.” We read this on 2026-10-26. Source and date
- Where is Miro's trust center?
- Miro publishes a page it calls “Trust Center” at trust.miro.com. Some of its documents sit behind a request or sign-in. The page mentions SOC 2, ISO 27001, a penetration test, subprocessors and a DPA. We read it on 2026-11-03. Source and date
- Does Miro use your data to train AI models?
- For every plan (Miro AI): customer data not used to train or refine AI models; Enterprise would need to explicitly opt in if this ever changes. Source and date
- What is Miro's data retention for AI prompts and outputs?
- For every plan (Miro AI): data isn't retained. Source and date
- Can Miro process AI data in the EU?
- For every plan (Miro AI): Miro AI data stored in-region (EU residency available for all plans); processing may occur outside the selected region where some AI models aren't yet available in-region. Source and date
- How does Miro transfer personal data out of the EU?
- Miro's agreement relies on the EU standard contractual clauses, the EU-U.S. Data Privacy Framework and the UK transfer addendum. Miro is on the official Data Privacy Framework List (status: Active). Source and date
- Does Miro offer EU data residency?
- The EU is the default region for this vendor. Source and date
- Who are Miro's subprocessors?
- Miro lists 15 third-party subprocessors; 12 of them name at least one processing country outside the EEA. We last read the list on 2026-10-26. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | RealtimeBoard Inc. dba Miro |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | 254900N7B1LWCBONJ991 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | miro.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Miro data residency
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | EU by default | Included on all plans | help.miro.com | 2026-09-18 |
EU: CORRECTION of our 2026-09-18 reading of terms-not-stated. Page states 'EU Data Residency: Available for all plans' and marks the European Union as the DEFAULT region, with the primary data centre in Ireland and backup in Germany. US, AU and JP residency, by contrast, are Enterprise-only. Excludes beta and preview features; AI processing may occur outside the region where models are unavailable.
The same question for every vendor: where SaaS vendors store EU data.
Miro's subprocessor list names AWS for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.
Subprocessor chain
15 third parties · 12 with a country outside the EEA · all read 2026-10-26
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon | — | — |
| Amazon Web Services, Inc. | US, AU, EU, JP | Infrastructure |
| Anthropic | — | — |
| Anthropic | US | AI Functionality |
| Braze | — | — |
| Braze, Inc. | US | Service Related Emails |
| ElevenLabs | US | Live Captions, Transcripts |
| Gainsight, Inc. | US | Customer Success/Support |
| Google LLC | US | Sensitive Data Discovery (Enterprise Guard) |
| Intercom | US | Customer Support (Chatbot) |
| Microsoft Corporation | US | Accessibility | OCR functionality | AI |
| OpenAI | US | AI Functionality |
| PartnerHero, Inc. | US | Customer Support |
| Skilljar, Inc. | US | Customer Training (Miro Academy) |
| Zendesk, Inc. | US | Customer Support Tickets |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · miro.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | UK Addendum |
| Notice of new subprocessors | At least 10 days prior notice of a new or replacement subprocessor, if the customer subscribes to notifications; Subprocessor List is updated |
| If you object to one | Customer may object in writing within 30 days after notice, on reasonable grounds related to data protection compliance; the parties discuss in good faith; if unresolved, Miro decides either not to appoint the subprocessor or to let the customer suspend or terminate the applicable Order/Agreement; this is the exclusive remedy |
| Obligations passed to subprocessors | imposes substantially the same data protection terms as this DPA on any Subprocessor (including data transfer provisions, where applicable); Miro remains liable for Subprocessor breaches |
| Breach notification | without undue delay |
| Deletion when the service ends | At the customer's request during the subscription term and/or at termination or expiry, the vendor deletes or returns all Customer Personal Data under its then-current deletion timelines and policies. This does not apply to data the vendor must keep by law or to data archived on backup systems; that data is isolated and protected from further processing. The vendor confirms deletion on written request. |
| Getting your data back | At the customer's request during the subscription term and/or at termination or expiry, the vendor returns (or deletes) all Customer Personal Data in its possession. |
| Requests from data subjects | reasonably cooperates with Customer to respond to data subject requests; requests made directly to Miro are passed on to Customer and not answered without Customer's express authorization unless required by law |
| Audit | Certifications, audit report summaries and other documentation on request; third-party audit only after a confirmed Security Incident or where a data protection authority requires it, on 30 days' prior written notice, at Customer's expense, with scope, timing and duration mutually agreed |
| Processing on your instructions | only in accordance with Customer's documented instructions; not for its own purposes except as set out in the Agreement and DPA or where required by law |
| Confidentiality of staff | personnel processing Customer Personal Data subject to an appropriate contractual or statutory duty of confidentiality |
| Security measures | reasonable and appropriate technical and organizational security measures listed in Exhibit 2; may be updated without degrading overall security |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Which version applies
On 2026-11-09, the agreement printed: Effective Date: September 17, 2024
at miro.com
In effect from 2024-09-17
This version is in our copies from 2026-10-09.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
AI and your data
What Miro's own pages state about the data you send its AI products, plan by plan. Compared with other vendors on AI vendors and your data.
| Plans | Term | What the page says | Source | Observed |
|---|---|---|---|---|
| All plans Miro AI | Training on your data | Not used customer data not used to train or refine AI models; Enterprise would need to explicitly opt in if this ever changes | help.miro.com | 2026-10-28 |
| All plans Miro AI | Data retention | Not stored data isn't retained | help.miro.com | 2026-10-28 |
| All plans Miro AI | EU processing | EU storage only Miro AI data stored in-region (EU residency available for all plans); processing may occur outside the selected region where some AI models aren't yet available in-region | help.miro.com | 2026-10-28 |
| All plans Miro AI | Model providers | Azure OpenAI | help.miro.com | 2026-10-28 |
Assurance
Does Miro have a SOC 2 report?
Miro says a SOC 2 Type 2 report is available on request. Miro also publishes a SOC 3 report. We read this on 2026-10-26.
- Available on request “Yes. Miro maintains SOC 2 Type II compliance. You can review this in the compliance section of this trust center.”
- Available on request “SOC 2 Type II Report 2025-2026”
- Available on request “Miro has officially released its latest SOC 2 Type II report for the period of December 1, 2024, to December 31, 2025.”
- Available on request “Miro has just released its SOC2 Type II report for the period of January 1st, 2024 to December 31st, 2024.”
- Claimed “SOC 2 Type II certification”
Source: trust.miro.com, 2026-10-26
Of the 114 vendors in this registry whose own pages mention SOC 2, 57 say the report is available on request, 1 links to the report itself, and 56 state it without saying how to get it. The type is the one the vendor names.
Is Miro ISO 27001 certified?
Miro states ISO/IEC 27001 certification (2022 edition, as Miro names it), and its own page links to the certificate. We read this on 2026-10-26.
- Certificate published “ISO / IEC 27001:2022 certification”
- Certificate published “Yes. Miro is ISO 27001 certified. You can review this certification in the compliance section of this trust center.”
- Certificate published “ISO/IEC 27001 Certificate”
- Certificate published “ISO/IEC 27001:2022 certification”
Source: trust.miro.com, 2026-10-26
Of the 122 vendors in this registry whose own pages state ISO/IEC 27001, 16 link to the certificate, 43 say it is available on request, and 63 state it without saying how to get it. A certificate names the certification body, the scope and the expiry date: those are the three things to check.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CCPA | Claimed | Data privacy and protection measures are embedded into product design, system development, and operational workflows | trust.miro.com | 2026-10-26 |
| CCPA | Claimed | Security and privacy programs; alignment, multiple jurisdictions | trust.miro.com | 2026-10-26 |
| Cyber Essentials · CyberEssentials | Available on request | — | trust.miro.com | 2026-10-26 |
| EU-US Data Privacy Framework · DPF | Claimed | personal data flowing to the United States from the European Union, United Kingdom, and Switzerland | trust.miro.com | 2026-10-26 |
| GDPR | Claimed | — | trust.miro.com | 2026-10-26 |
| GDPR | Claimed | Data privacy and protection measures are embedded into product design, system development, and operational workflows | trust.miro.com | 2026-10-26 |
| GDPR | Claimed | Security and privacy programs; alignment, multiple jurisdictions | trust.miro.com | 2026-10-26 |
| IRAP | Available on request | — | trust.miro.com | 2026-10-26 |
| ISO / IEC 27001:2022 · ISO27001 | Certificate published | — | trust.miro.com | 2026-10-26 |
| ISO 27001 · ISO27001 | Certificate published | — | trust.miro.com | 2026-10-26 |
| ISO/IEC 27001 · ISO27001 | Certificate published | — | trust.miro.com | 2026-10-26 |
| ISO/IEC 27001:2022 · ISO27001 | Certificate published | covers all relevant operations, systems, and processes organization-wide | trust.miro.com | 2026-10-26 |
| ISO 42001 · ISO42001 | Claimed | AI management systems standard | trust.miro.com | 2026-10-26 |
| ISO 42001:2023 · ISO42001 | Claimed | The artificial intelligence management system | trust.miro.com | 2026-10-26 |
| ISO/IEC 42001 · ISO42001 | Claimed | production and continuous improvement of AI-enabled SaaS across EMEA, USA and other key regions | trust.miro.com | 2026-10-26 |
| ISO/IEC 42001:2023 · ISO42001 | Available on request | — | trust.miro.com | 2026-10-26 |
| CIS benchmarks | Claimed | — | trust.miro.com | 2026-10-26 |
| SOC 2 Type II · SOC2T2 | Available on request | — | trust.miro.com | 2026-10-26 |
| SOC 2 Type II · SOC2T2 | Available on request | Report 2025-2026 | trust.miro.com | 2026-10-26 |
| SOC 2 Type II · SOC2T2 | Available on request | period of December 1, 2024, to December 31, 2025; internal controls including those governing AI features, modern infrastructure, and automated governance; security, availability, and confidentiality | trust.miro.com | 2026-10-26 |
| SOC 2 Type II · SOC2T2 | Claimed | security, availability and confidentiality controls over a year-long period | trust.miro.com | 2026-10-26 |
| SOC2 Type II · SOC2T2 | Available on request | period of January 1st, 2024 to December 31st, 2024 | trust.miro.com | 2026-10-26 |
| SOC 3 · SOC3 | Certificate published | Report 2025-2026 | trust.miro.com | 2026-10-26 |
| SOC 3 · SOC3 | Certificate published | security, availability, and confidentiality | trust.miro.com | 2026-10-26 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Miro | Active | non-HR data | 2027-07-27 | 2026-10-05 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Miro | Active | non-HR data | 2027-07-27 | 2026-10-05 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Miro | Active | non-HR data | 2027-07-27 | 2026-10-05 |
| Global LEI Index (GLEIF) | REALTIMEBOARD, INC. · REALTIMEBOARD, INC. | ISSUED | US-DE | 2027-01-30 | 2026-10-08 |
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under Miro; RealtimeBoard Inc. dba Miro; RealtimeBoard, Inc. dba Miro
- ISO 27001 on the basis of IT-Grundschutz (BSI, Germany): checked 2026-11-09, no entry under Miro; RealtimeBoard Inc. dba Miro; RealtimeBoard, Inc. dba Miro
- CISPE Data Protection Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Miro; RealtimeBoard Inc. dba Miro; RealtimeBoard, Inc. dba Miro
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under Miro; RealtimeBoard Inc. dba Miro; RealtimeBoard, Inc. dba Miro
- Data Privacy Framework List (US): checked 2026-11-09, 3 entries under Miro; RealtimeBoard Inc. dba Miro; RealtimeBoard, Inc. dba Miro
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under Miro; RealtimeBoard Inc. dba Miro; RealtimeBoard, Inc. dba Miro
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Miro; RealtimeBoard Inc. dba Miro; RealtimeBoard, Inc. dba Miro
- FedRAMP Marketplace (US): checked 2026-11-09, no entry under Miro; RealtimeBoard Inc. dba Miro; RealtimeBoard, Inc. dba Miro
- GPAI Code of Practice signatories (European Commission): checked 2026-11-09, no entry under Miro; RealtimeBoard Inc. dba Miro; RealtimeBoard, Inc. dba Miro
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under Miro; RealtimeBoard Inc. dba Miro; RealtimeBoard, Inc. dba Miro
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Miro (SaaS) | — | Service only | unknown | miro.com | 2026-09-18 |
Vulnerability reporting: no security.txt at the well-known path (read 2026-10-17)
How other vendors publish theirs: security.txt across the registry.
Documents
Where is Miro's trust center?
Miro publishes a page it calls “Trust Center” at trust.miro.com. Some of its documents sit behind a request or sign-in. The page mentions SOC 2, ISO 27001, a penetration test, subprocessors and a DPA. We read it on 2026-11-03. Open trust.miro.com
- Name “Welcome to Miro's Trust Center, where our commitment to data privacy and security is central to our”
- Request step “including the specific controls and policies implemented by our teams. You can explore our compliance standards, request access to comprehensive security documentation, and gain a clear understanding of how we safeguard your data.”
Source: trust.miro.com, 2026-11-03. Read from the page's text, without a model; every vendor's trust center.
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| ai | Public | full | 200 | 2026-10-28 |
| ai-2 | Public | full | 200 | 2026-10-28 |
| certifications | Public | full | 200 | 2026-10-26 |
| dpa | Public | full | 200 | 2026-10-09 |
| subprocessors | Public | full | 200 | 2026-10-26 |
| trust-center | Gated | partial | 200 | 2026-09-18 |
History
| Detected | What moved | Why | Source |
|---|---|---|---|
| 2026-10-26 | Status Claimed → Available on request | the vendor changed it | trust.miro.com |
| 2026-10-26 | Status Claimed → Certificate published | the vendor changed it | trust.miro.com |
| 2026-09-18 | EU data location Terms not stated → EU by default Minimum plan set to Included on all plans Note rewritten | we read a better page | help.miro.com |
Every reviewed change across the registry, newest first: vendor changes.