Security at Milvao

Milvao holds details about your members, so security is built into how it works, not added on. Here are the main protections, and what you can do to help. The full list of controls, what is still planned and our compliance roadmap are in the trust centre, and the providers that process data for Milvao are on the sub-processors page.

How your data is protected#

• Separation between communities. Every record belongs to one community. The database itself refuses links between communities, and the app checks your access on every page and action. Trying to open another community's page shows "not found", without saying whether it exists.
• Encryption. All traffic uses HTTPS, and browsers are told to use it every time. Members' phone numbers and WhatsApp access tokens are encrypted at rest.
• Hashed links and codes. Join codes, profile links and team invites are stored only as one-way hashes. That's why a join link is shown only once.
• Masked numbers. Phone numbers show only their last 4 digits in the dashboard, for everyone. Only the owner can export full numbers, with a reason that is recorded in the activity log.
• Separate logs. Audit and security logs live in their own database, apart from community data. Logs never contain message text, passwords, tokens or full phone numbers.

Signing in#

• Controlled accounts. Team members join a community only with an invite to their email.
• Passwords are at least 10 characters and stored hashed. Resetting a password signs you out on every other device.
• Two-factor sign-in with an authenticator app is optional and recommended: a reminder appears after sign-in until it's on, and nobody is blocked from signing in without it. See Two-factor sign-in.
• Bot protection. Sign-in, accepting an invite and password reset use Cloudflare Turnstile. Milvao briefly slows repeated sign-in attempts.
• Owner-only settings. Only owners can change the matching mode, community details and the team. See Roles and your team.

Member profile links#

• A profile link works once and for 60 minutes.
• Opening the link only shows a page. The link is used up when the member taps Continue to your profile, so WhatsApp link previews can't use it.
• The profile page then works for up to an hour and can only see and change that one member's profile.
• Repeated attempts from one connection are slowed down, and invalid links are recorded.

Messages from WhatsApp#

• Every message WhatsApp sends to Milvao is checked for a valid signature before it's accepted.
• Each message is handled once, even if WhatsApp delivers it twice.
• A message is routed to your community only by the business number it was sent to.
• To stop people guessing join codes, each phone number can try at most 20 JOIN codes an hour.

Audit and monitoring#

• Audit log. Every change by your team (groups, links, verifications, settings, team changes) and every action by Milvao staff is recorded with who, what and when.
• Security events. Failed sign-ins, failed two-factor codes, blocked sign-ups, rate-limit hits, invalid links and attempts to open another community are recorded and reviewed by Milvao staff.

What you can do#

• Turn on two-factor sign-in for your account, and ask your operators to do the same.
• Remove operators in Settings → Team as soon as they leave your team.
• Revoke and replace a join link if it was posted somewhere public.
• Don't share your password, and sign out on shared computers.

Report a security problem#

Found a security problem? Email hello@milvao.com with "Security" in the subject. Please don't test against other communities' data. The rules for testing and what to include are in the trust centre.