Security at Milli

We hold financial records, tax identifiers and identity documents. This page sets out how they are protected - specifically, not in slogans.

Where your data lives

In the UK. Our database and document storage run in London (Supabase, AWS eu-west-2), and the application is served from London (Vercel). Everything is encrypted in transit (TLS) and at rest.

Who can see what

Access is enforced at the database layer with row-level security: your session can only ever reach your own records, in every table. Our team's access is role-based and permission-gated, and every action anyone (or any AI) takes on client data lands in a permanent audit log - who, what, when, on whose authority. Documents are served through signed links that expire in minutes, never public URLs.

AI, handled carefully

The AI that does your day-to-day accounting work processes your data under contract with our provider (Anthropic); it is not used to train their models. Every AI decision is logged with its inputs and reasoning, reviewed by our accountant team where it matters, and nothing reaches HMRC or Companies House without recorded human approval. The AI never holds credentials: we never ask for your Government Gateway or bank logins - authorising us as your agent happens in your own Government Gateway, on HMRC's own pages.

Hardened by default

• Strict transport security (HSTS) and clickjacking protection on every page.
• Magic-link sign-in by default - no passwords to steal or reuse.
• Rate limits on the AI endpoints and lockouts on sensitive access codes.
• Secrets live in the deployment environment, never in code or the browser.
• Payment details are held by Stripe (PCI DSS Level 1) - we never see card numbers.

Found something?

If you believe you've found a security issue, email hello@trymilli.com with the details. We take reports seriously, respond quickly, and won't pursue good-faith research.