Security
An overview of the security practices behind Milo Growth. We aim to be transparent about what we do today and what is still maturing.
Security overview
Milo is built on managed infrastructure with authentication, access control and server-side handling of sensitive values. Security is an ongoing process and this page reflects our current practices during the beta.
Authentication
Access to the app requires authentication. Sign-in is handled by our managed auth provider, and requests to your data are scoped to your authenticated session.
Workspace and project access
Data is organised by workspace and project, and is only accessible to the account it belongs to. Users see only the projects within their own workspace.
Access control (row-level security)
Data access is enforced server-side using row-level security so that queries are restricted to the authenticated user's own records.
Server-side secrets
Service credentials and integration secrets are used only on the server. They are not exposed to the browser or embedded in client code.
Publishing secrets
When you connect a website, the publish secret is stored privately and sent only as a request header to your configured endpoint. The same secret must be configured on your target website. It is not shown publicly or shared with other users.
Analytics privacy
Milo Analytics is privacy-conscious: it uses anonymous visitor/session IDs, does not store full IP addresses, and does not capture names or emails through analytics events. See the Cookie & Analytics Policy.
Backups
[Backup and recovery details to be confirmed.] Database infrastructure is provided by our managed backend provider.
Monitoring and error handling
[Monitoring details to be expanded.] The application includes server-side and client-side error reporting to help us detect and resolve issues.
Vulnerability / security contact
To report a security concern, contact security@milogrowth.com.
Incident response
[Incident response process to be formalised.] We aim to investigate reported issues promptly and notify affected users where appropriate.
Responsible disclosure
[Responsible disclosure policy to be formalised.] We welcome good-faith reports from security researchers and ask that you give us a reasonable opportunity to address issues before public disclosure.
Enterprise certifications
Milo is not currently ISO 27001 or SOC 2 certified. These may be considered later as the product matures. We do not claim certifications or penetration tests that we do not hold.