Skip to content

Mideye GDPR & Data Residency Compliance

Understanding where your data lives is critical for compliance. This page explains exactly what data Mideye processes, where it’s stored, and which jurisdictions apply.

For how the components work, see System Architecture. For step-by-step authentication sequences, see Authentication Flows.


DataWhere it livesControlled by
User accounts, passwords, token seedsYour Mideye Server databaseYou
Authentication logs and audit logsYour Mideye ServerYou
Configuration and encryption keysYour Mideye ServerYou
SMS content (during delivery)Mideye Switch (Sweden) — not stored after deliveryMideye
Switch operational logsLog analytics (Sweden) — 30 daysMideye
Push notification payloadsMideye Cloud (Sweden) — not stored after deliveryMideye
Cloud operational logsLog analytics (Sweden) — 30 daysMideye
Magic Link sessionsMideye Cloud (Sweden) — session duration onlyMideye
IP reputation dataMideye Cloud (Sweden)Mideye

Key principle: Your credentials and authentication decisions never leave your infrastructure. Mideye’s cloud services only handle message delivery and session coordination.


All persistent data lives on your Mideye Server:

Data typeStorage locationNotes
User accounts and attributesYour database (MySQL, MariaDB, or MsSQL)You choose the database
Passwords and hashesYour databaseNever sent to Mideye
TOTP token seedsYour databaseEncrypted
Authentication policiesYour databasePer-client and per-user
Authentication logsYour databaseEvery attempt logged
Encryption keys (keystore.p12)Your server file systemYou manage the keys
Configuration (application-prod.yml)Your server file systemAll settings local

When a user authenticates, some data passes through Mideye’s services for delivery purposes:

DataPurposeRetention
Phone numbersRoute SMS to the correct carrierNot stored after delivery
OTP codesDeliver via SMSNot stored after delivery
Push/Touch requestsRoute to Plus services in the cloudNot stored
Token validation requestsForward to Yubicloud or HIDNot stored
Operational logs (metadata only)Service monitoring and troubleshooting30 days (log analytics, Sweden)

The Switch does not store message content after delivery. Operational logs (timestamps, delivery status, error codes) are retained for 30 days in centralized log analytics in Sweden for monitoring and troubleshooting. These logs do not contain usernames, passwords, OTP codes, or authentication policies.

DataPurposeRetention
Magic Link sessionsHost the approval pageSession duration only
Push notification payloadsDeliver approve/reject challenge to appNot stored after delivery
IP addressesShield threat assessmentConfigurable
RADIUS session eventsSession management in Mideye+ appSession duration only
Operational logs (metadata only)Application monitoring and troubleshooting30 days (log analytics, Sweden)

Mideye Cloud runs in Europe-based cloud infrastructure in Sweden. Operational logs (timestamps, API requests, error codes, performance metrics) are retained for 30 days in centralized log analytics for monitoring and troubleshooting. These logs do not contain user credentials, OTP codes, or message content.

Push notifications and SMS pass through external providers:

ServiceData processedProvider location
Apple Push (APNs)Device token, notification payloadUSA (Apple)
Google Push (FCM)Device token, notification payloadUSA (Google)
SMS providersPhone number, message contentVaries by carrier
Data transfers to US-based push notification services are governed by the respective provider terms. Both Apple and Google participate in the EU-US Data Privacy Framework.
Push notification payloads contain only a challenge identifier — no user credentials, no authentication tokens.

These data types never leave your infrastructure:

  • Usernames, passwords, and credentials
  • LDAP/AD queries and responses
  • RADIUS shared secrets
  • Authentication decisions (accept/reject)
  • All audit and authentication logs
  • Token seeds and encryption keys

All Mideye-operated services run in Sweden:

ServiceData centerLocation
Mideye Switch (Primary)Swedish DC 1Sweden
Mideye Switch (Secondary)Swedish DC 2Sweden
Mideye CloudEurope-based cloud (Sweden)Sweden

Both Switch data centers are within EU jurisdiction and subject to Swedish data protection law.


Mideye is a Swedish company subject to GDPR.

RoleWho
Data ControllerYour organization (you decide what data to process)
Data ProcessorMideye (for message routing through Switch and cloud services)

In an on-premises deployment where you only use Mideye Switch for SMS delivery, Mideye’s role as processor is limited to message routing and operational logging (30-day retention in Sweden).


Mideye provides the following security capabilities that organizations may evaluate for their regulatory requirements:

CapabilityImplementation
Multi-factor authenticationCore product capability
Access controlUser and group policies
Audit loggingComprehensive authentication logs
Incident detectionFailed login monitoring, Mideye Shield
Supply chain securitySwedish/EU hosting (operational logs in Sweden)

All Mideye-operated services process data exclusively within the EU:

  • Mideye Switch: Sweden
  • Mideye Cloud: Sweden
  • Support systems: Sweden/EU

The following services may transfer data outside the EU:

ServiceTransfer destinationMechanism
Apple Push (APNs)USAProvider terms; EU-US Data Privacy Framework
Google Push (FCM)USAProvider terms; EU-US Data Privacy Framework
SMS deliveryCarrier-dependentVaries

If your compliance requirements prohibit non-EU data transfers, use authentication methods that don’t require push or SMS:

  • On-premise TOTP (authenticator apps or hardware tokens)
  • Air-gapped mode (no Mideye cloud connectivity needed)

Your Mideye Server data (user accounts, credentials, token seeds, authentication logs, configuration) is stored on your infrastructure and is not subject to US jurisdiction.

Mideye operational logs are stored in centralized log analytics (Sweden region, 30 days retention). Logs are stored and processed within European infrastructure. These logs contain only operational metadata (timestamps, delivery status, error codes) — not user credentials, OTP codes, or message content.

Message delivery services (Apple Push, Google FCM) are US companies. Push notification payloads contain only challenge identifiers, not credentials.

For maximum data sovereignty, use air-gapped mode with on-premise TOTP authentication, which eliminates all external dependencies.