MIRA is built for professionals handling sensitive documents and proprietary data. Every architectural decision reflects that.
Privacy guarantees
| Guarantee | How it works |
|---|
| 🚫 No telemetry | MIRA collects zero usage data, crash reports, or analytics. There is no analytics pipeline in the codebase. |
| 🚫 No cloud storage | Conversations, documents, and credentials never leave your machine, except as part of LLM API calls you explicitly initiate. |
| 🔐 OS keychain encryption | All secrets (AWS keys, API tokens, MCP credentials) are stored in your OS native keychain — macOS Keychain, Windows Credential Manager, or libsecret on Linux. They are never written to disk in plaintext. |
| 🔒 Secrets never in logs | Two-layer automatic redaction: one in the main process before writing to electron-log, one before any value reaches the renderer or the REPL console. |
| 🛡️ Renderer isolation | The UI runs with nodeIntegration: false and contextIsolation: true. It has no direct access to fs, child_process, keytar, or better-sqlite3. All operations go through typed IPC. |
| 📴 Offline capable | MIRA works fully without internet after initial environment setup. The only network calls are LLM API requests and MCP server connections you explicitly configure. |
Outbound network calls
MIRA makes outbound network calls only for:
- LLM API calls — when you send a query, your prompt (including any document context you’ve injected) is sent to your configured provider (AWS Bedrock, Anthropic, OpenAI, or Ollama locally). If you use Ollama, zero outbound calls are made for inference.
- MCP server calls — when you’ve added and enabled an MCP server (e.g. web search), the engine calls it during reasoning.
- Update check — a lightweight version check on launch. This can be disabled in Settings → Preferences.
Nothing else ever leaves your machine.
Where your data lives
All MIRA data is stored locally. Nothing is synced to any cloud service.
| Platform | Path |
|---|
| macOS | ~/Library/Application Support/MIRA/ |
| Windows | %APPDATA%\MIRA\ |
| Linux | ~/.config/MIRA/ |
| File / Folder | Contents |
|---|
mira.db | All sessions, messages, documents (as parsed text chunks), skills, workflows, eval definitions, and app settings. SQLite format. |
mira-venv/ | Isolated Python virtual environment created on first launch. Contains no user data. |
logs/ | Application logs. All credential values are automatically redacted before write. |
Document handling
When you upload a document:
- MIRA reads it from disk on your machine
- Parses it in a background worker thread
- Stores the parsed text chunks in
mira.db — locally
- When you run a query, the chunks are injected into the prompt payload sent to your LLM provider
Documents are never uploaded to any MIRA server. The only time document content leaves your machine is inside the prompt payload sent to your chosen LLM API.
Credentials
All secrets are stored in your OS keychain — never on disk.
MIRA uses keytar to store credentials in macOS Keychain, Windows Credential Manager, or
libsecret on Linux. They are never written to mira.db, log files, or any config file.
The renderer process never holds secret values after the save call completes.
Log redaction
electron-log runs all log entries through a sanitisation filter before writing to disk. The filter strips any string matching known secret patterns (AWS keys, API tokens, MCP secrets). The REPL Console applies a second layer of redaction before displaying any value — all environment variable values appear as [REDACTED].
Verifying privacy
Because MIRA is fully open source, you can verify every privacy claim by reading the source:
