Privacy guarantees
Outbound network calls
MIRA makes outbound network calls only for:- LLM API calls — when you send a query, your prompt (including any document context you’ve injected) is sent to your configured provider (AWS Bedrock, Anthropic, OpenAI, or Ollama locally). If you use Ollama, zero outbound calls are made for inference.
- MCP server calls — when you’ve added and enabled an MCP server (e.g. web search), the engine calls it during reasoning.
- Update check — a lightweight version check on launch. This can be disabled in Settings → Preferences.
Where your data lives
All MIRA data is stored locally. Nothing is synced to any cloud service.Document handling
When you upload a document:- MIRA reads it from disk on your machine
- Parses it in a background worker thread
- Stores the parsed text chunks in
mira.db— locally - When you run a query, the chunks are injected into the prompt payload sent to your LLM provider
Credentials
All secrets are stored in your OS keychain — never on disk.
MIRA uses
keytar to store credentials in macOS Keychain, Windows Credential Manager, or
libsecret on Linux. They are never written to mira.db, log files, or any config file.
The renderer process never holds secret values after the save call completes.Log redaction
electron-log runs all log entries through a sanitisation filter before writing to disk. The filter strips any string matching known secret patterns (AWS keys, API tokens, MCP secrets). The REPL Console applies a second layer of redaction before displaying any value — all environment variable values appear as [REDACTED].
Verifying privacy
Because MIRA is fully open source, you can verify every privacy claim by reading the source:- Telemetry: search for
analytics,telemetry,segment,amplitude— you’ll find nothing - Keychain:
src/main/credential-store.ts— allkeytaroperations - Log redaction:
src/main/logger.ts— the sanitisation filter - IPC isolation:
src/preload/index.ts— thecontextBridgewhitelist