Data Security Policy

Your financial data is among the most sensitive information you own. This Data Security Policy explains how Milli protects it. For our broader corporate program, see our Security Policy.

1. Encryption

In transit: all data exchanged between the Milli apps, drivemilli.com, and Milli servers is encrypted using TLS 1.2 or higher with modern cipher suites. The Milli apps enforce App Transport Security and certificate validation.
At rest: customer data is encrypted using AES-256. Highly sensitive fields, such as Social Security numbers and identity documents, receive additional field-level encryption.
Key management: encryption keys are managed in a hardware-backed key management service, access is restricted and logged, and keys are rotated on a defined schedule.
On device: sensitive tokens are stored in the iOS Keychain, and the app supports Face ID, Touch ID, and passcode locks.

2. Secure Plaid Integration

Milli partners with Plaid to connect your financial accounts. When you link an account, you authenticate directly with your financial institution through Plaid's secure interface. Your bank login credentials are never shared with or stored by Milli. Milli receives a secure access token, stored encrypted, that allows read access to the data you authorized. You can revoke access at any time by disconnecting the account in Milli or through Plaid Portal at my.plaid.com.

3. Certification Status

Milli's security program is designed to the AICPA SOC 2 Trust Services Criteria for Security, Availability, and Confidentiality. Milli's SOC 2, ISO 27001, and PCI DSS certifications are in process; Milli does not currently hold these certifications. See our SOC 2 Compliance Summary and PCI DSS Compliance Statement.

4. Account Protections

Multi-factor authentication, real-time login alerts, new device notifications, session management, and the ability to sign out of all devices from the app.

5. Fraud Monitoring

Automated systems continuously monitor for suspicious account activity, credential stuffing, unusual device or location patterns, and anomalous transactions, with escalation to Milli's risk team.

6. Data Minimization and Privacy-First Handling

We only collect the data needed to provide our services. Your information is never sold. Access to customer data by Milli personnel is restricted, logged, and permitted only for support, security, or legal purposes. Test and development environments do not use real customer data.

7. Cardholder Data

Milli Elite Card data is handled by PCI DSS validated partners. See our PCI DSS Compliance Statement.

8. Retention and Secure Disposal

Data is retained only as described in our Privacy Policy. When data is no longer needed, it is securely deleted using cryptographic erasure or industry-standard disposal methods. Under the Safeguards Rule, customer information is disposed of no later than two years after it was last used to provide a service, unless retention is required by law or a legitimate business need.

9. Data Breach Notification Procedures

If Milli discovers a security incident involving unauthorized acquisition of customer information, Milli will: 1. activate its incident response plan immediately to contain and investigate the incident; 2. notify affected customers without unreasonable delay, and within the time required by applicable state law, by email and in-app notice, describing what happened, what information was involved, what we are doing, and what you can do; 3. notify the Federal Trade Commission within 30 days of discovery when an event involves the information of 500 or more consumers, as required by the Safeguards Rule; 4. notify state attorneys general, consumer reporting agencies, partner banks, and other regulators as required; 5. for EEA and UK users, notify the competent supervisory authority within 72 hours where required by GDPR; and 6. offer appropriate support, which may include credit monitoring, where warranted.

10. Your Role

Use a unique password, enable Face ID or Touch ID and multi-factor authentication, keep your device updated, and never share verification codes. Milli will never ask for your password or a verification code by phone, email, or text.

11. Contact

Report a security concern at security@drivemilli.com or (888) 645-5114.