Security Statement
This page describes the security controls actually implemented in MilesPlus today, and is explicit about what is not yet in place — we would rather understate our security posture than claim something we can't back up.
1. Tenant data isolation
MilesPlus is a multi-tenant application: every organisation's data is scoped by a tenant identifier and enforced at the application layer, with automated checks in our development process specifically aimed at catching any code change that would weaken this isolation.
2. Account security
- Passwords are never stored in plain text — they are hashed using industry-standard one-way hashing.
- Login and registration attempts are rate-limited to slow down credential-guessing attacks.
- Sessions include protection against a stolen session cookie being reused after your credentials change.
- Platform administrator access is gated behind a separate, non-discoverable entry point, additional rate limiting, and (optionally, per deployment) an IP address allow-list.
3. Administrative access and auditing
Platform administrator actions that affect a tenant — suspending or reactivating an account, or accessing an account to provide support — are logged with who performed the action, when, from what IP address, and (where applicable) why. See the Privacy Policy for what "support access" means in practice.
4. What is not yet in place
In the interest of accuracy, these are gaps we're aware of and have not yet closed:
- Two-factor authentication is not currently enabled for any account, including platform administrators.
- MilesPlus has not undergone an independent security audit, penetration test, or certification (such as SOC 2 or ISO 27001).
- Whether production traffic enforces HTTPS-only cookies end-to-end has not been independently confirmed as part of this document.
- There is no public bug bounty program.
5. Reporting a security issue
If you believe you've found a security vulnerability in MilesPlus, please report it to support@milesplus.com rather than disclosing it publicly, and give us a reasonable opportunity to investigate and respond before any public disclosure.
6. Changes to this statement
As security controls are added or changed, this page will be updated to reflect what's actually true at the time.