How Milvao protects your community's data
Encrypted numbers and tokens, each community's data kept apart and every action in a separate audit log. Not certified, but mapped to SOC 2 and ISO 27001.
Last updated
How your data is protected
Each control below is built and running. Planned work is listed separately, further down, so the two never blur.
Member data
The details members share are protected in the database itself, not only in the screens.
Phone numbers encrypted at rest
In placeMembers' numbers are encrypted with AES-256-GCM. Lookups use a keyed hash, and the dashboard shows only the last 4 digits, for everyone on the team. Only the owner can export full numbers, after giving a reason that is audited.
Links and codes stored as hashes
In placeJoin codes, profile links and team invites are stored only as SHA-256 hashes, so a copy of the database doesn't hand out working links.
Profile links that can't be reused
In placeA profile link works once and for 60 minutes. Opening it only shows a page, so link previews can't use it up.
Contacts shared only after two yeses
In placeA number is sent only when the person asking allowed it for that request and the matched member accepted. Both consents are checked again right before sending.
Redacted text for AI
In placeOnly request text, with phone numbers, emails and links removed, goes to the AI model that writes the brief. The directory, numbers and profile answers are never sent.
Separation between communities
One community can never reach another community's records, even through a bug in a screen.
Enforced by the database
In placeEvery record that belongs to a community carries its workspace, and the database refuses links between records of different workspaces.
Checked on every request
In placeAccess is checked on every page and action. Asking for another community's record answers "not found", without saying whether it exists, and the attempt is recorded.
Messages routed by business number
In placeAn incoming WhatsApp message reaches a community only through the business number it was sent to.
Accounts and staff access
Few people can see data, and each of them can see only what their role needs.
Invitation-only accounts
In placeNobody can create an account without an invite to their email. Passwords are at least 10 characters and stored hashed, and a reset signs out every other device.
Two-factor sign-in
In placeAvailable to everyone with an authenticator app and backup codes. Optional, with a reminder after sign-in until it is on. Staff need it to open a workspace through support access.
Least-privilege roles
In placeStaff are owner, admin or support, each with its own permissions. In a community, only the owner can change settings, the team, billing and the WhatsApp connection.
Support access only with permission
In placeMilvao staff can open a workspace only after its owner grants access for 1 hour, 24 hours or 7 days. The view is read only, and every page support opens is listed for the owner.
One-click account lock
In placeStaff can lock an account and end all its sessions at once, with a reason that goes into the audit trail.
Audit trail and monitoring
Every action leaves a record that the app itself can't rewrite.
Separate logs database
In placeThe audit trail, security events and AI call logs live in their own database, apart from community data.
Audit trail of every action
In placeChanges by operators and every action by Milvao staff are recorded with who, what, when and from where.
Security events and alerts
In placeFailed sign-ins, failed two-factor codes, bot checks, rate-limit hits, bad webhook signatures and cross-community attempts are recorded. Serious ones alert staff by email and WhatsApp.
Nothing sensitive in logs
In placeLogs never contain passwords, tokens, secrets, message text or full phone numbers.
Abuse prevention
Public entry points are checked before anything reaches the data.
Cloudflare Turnstile
In placeEvery public form, sign-in, invite acceptance and password reset uses Cloudflare Turnstile to tell people from bots.
Rate limits and validation
In placeEvery public endpoint is rate limited across servers, and every input is validated with length limits.
Signed webhooks
In placeMessages from WhatsApp and payment events from Stripe and Razorpay are accepted only with a valid signature.
Outreach limits
In placeAt most 3 members are asked per request, one at a time, and a member gets at most 2 offers in any 7 days.
Security headers
In placeHTTPS everywhere with HSTS, a content security policy, and protection against framing and content sniffing.
Payments and connections
The most sensitive credentials never reach Milvao, or are sealed when they do.
No card data at Milvao
In placePayments run on Stripe's hosted checkout and Razorpay Checkout. Milvao receives only the card brand and last 4 digits for display.
WhatsApp tokens sealed
In placeThe token an owner pastes to connect their number is encrypted before storage, never shown again, and never logged.
Secrets outside the code
In placeKeys live only in encrypted environment settings, never in the code repository.
How long data is kept
Daily jobs delete data when its period ends. Message text is cleared after 90 days even while a member stays in the community.
- Raw message data received from WhatsApp
- 7 days
- Message text
- 90 days
- AI call logs (redacted)
- 90 days
- Copies of Razorpay payment events
- 30 days, with contact and card details removed
- Audit trail and security events
- 1 year
- Member profiles, consent records and introduction history
- Until the member or the community asks for deletion
Members can ask for a copy or deletion
Members send MY DATA or DELETE MY DATA to your community's number. The request appears for the owner in Settings, Data requests, with a 30-day due date. Owners can also log requests that reach them another way, and Milvao staff log requests sent to us.
Deleting a member removes their profile, profile answers, phone number, and request and message text, and stops any offers to them. Counts that can't identify them and the record of their consents stay, so metrics still add up and consent can be proven. A contact already shared with another member can't be taken back.
Every export and deletion is recorded in the audit trail. More detail: Handling members' data requests and how Milvao supports the DPDP Act.
If something goes wrong
Security events are recorded as they happen, and serious ones alert Milvao staff straight away.
Detect
Serious security events and spikes in failed sign-ins alert Milvao staff by email and WhatsApp.
Contain
Staff can lock an account and end its sessions in one step, suspend a workspace, or rotate a key.
Tell you
If a breach affects your community's data, we inform the owner without undue delay, with what we know, so you can meet your own duties.
Notify and learn
We help you notify the Data Protection Board of India and affected people and, where the GDPR applies, the supervisory authority within its 72-hour deadline. Then we record what happened and what we changed.
Aligned with the frameworks, not certified
Milvao holds no certifications and shows no badges. We keep a control register mapped to SOC 2, ISO/IEC 27001, India's DPDP Act and the GDPR, and this is where each one stands.
| Framework | Where we are | Next step |
|---|---|---|
| SOC 2 | Not audited. Controls are mapped to the Trust Services Criteria in an internal register. | Write the policies, finish the risk register and planned controls, then prepare for a Type I audit. |
| ISO/IEC 27001:2022 | Not certified. The same controls are mapped to Annex A. | Set up the management system (scope, policies, risk treatment) alongside the SOC 2 work. |
| India's DPDP Act 2023 | Consent per purpose, a privacy notice link in the first message, data requests and retention limits are built. | Finish the legal review of the privacy policy and name a grievance officer. |
| GDPR | Processor role, consent records, access and erasure tools and the sub-processor list are in place. | Finalise the data processing agreement and records of processing. |
Planned, not built yet
These controls are on our list and not in place today. Each moves up to the section above only once it is running.
- Planned: Cloudflare web application firewall and bot rules in front of milvao.com and app.milvao.com
- Planned: Automated tests and dependency and secret scanning on every code change, blocking merges that fail
- Planned: Point-in-time database restore, nightly encrypted backups and a regular restore test
- Planned: An external penetration test before the first paying customer after the pilots
- Planned: A written key rotation procedure and separate keys per environment
- Planned: A logs database role that can add and read records but not change them
- Planned: Uptime monitors for the app, the WhatsApp webhook and this website
- Planned: Quarterly review of staff and owner access, and a staff offboarding checklist
- Planned: Written security policies, a risk register and a breach notification runbook
- Planned: Signed data processing agreements and security reports collected from every provider
Found a security problem? Tell us.
Email hello@milvao.com with “Security” in the subject. A dedicated security address will replace it; the trust centre and our security.txt will change on the same day.
Please include what you found, where, the steps to reproduce it and what an attacker could do with it. We reply within one working day, keep you updated while we fix it, and credit you if you would like.
We don't run a paid bug bounty yet.
Rules for testing
- Test only against your own account or a workspace you are allowed to use.
- Don't access, change or delete another community's data. If you reach any by accident, stop and tell us.
- Don't message members' phone numbers or send messages through a community's business number.
- No denial of service, spam, social engineering of staff or customers, or physical attacks.
- Give us a reasonable time to fix a problem before you share it publicly.
We will not pursue good-faith research that follows these rules.
Security questions
Questions about your data? Email hello@milvao.com.