Security Policy

This Security Policy describes the corporate information security program Milli uses to protect its people, systems, and the customers who trust us with their financial lives. It complements our Data Security Policy, which focuses on how customer data is protected.

1. Governance

Milli maintains a written information security program consistent with the FTC Standards for Safeguarding Customer Information (16 C.F.R. Part 314, the "Safeguards Rule") and designed to the AICPA SOC 2 Trust Services Criteria.
A designated Qualified Individual oversees and enforces the program and reports in writing to senior leadership at least annually on its status, material risks, and recommended changes.
Security policies are reviewed at least annually and whenever there is a material change to Milli's business or threat environment.
A formal risk assessment is performed at least annually, identifying reasonably foreseeable internal and external risks and the controls that address them.
Certification status: SOC 2 (In Process), ISO 27001 (In Process), and PCI DSS (In Process). Milli does not currently hold these certifications, and this policy will be updated as each is completed.

2. Physical Security

Milli is a cloud-native company and does not operate its own data centers. Production systems are hosted with major cloud infrastructure providers whose facilities maintain independent SOC 2 and ISO 27001 attestations and enforce 24/7 security staffing, video surveillance, biometric and badge access controls, and environmental protections. Company devices are encrypted, centrally managed, screen-locked, and remotely wipeable. Customer data is never stored on removable media or personal devices.

3. Access Controls

Least privilege: access is granted on a need-to-know basis according to job role and approved by the system owner.
Strong authentication: single sign-on and phishing-resistant multi-factor authentication are required for all workforce access to company and production systems.
Production access: limited to a small number of authorized engineers, granted just-in-time, time-bound, and fully logged.
Access reviews: user access is reviewed at least quarterly, and privileged access monthly.
Offboarding: all access is revoked within 24 hours of separation, and immediately for involuntary separations.

4. Workforce Security

Background checks, where permitted by law, before granting access to customer data
Confidentiality and acceptable use agreements signed at hire
Security and privacy awareness training at onboarding and at least annually, including phishing simulations
Role-specific training for engineering (secure coding) and support (social engineering and identity verification)
A clear-desk, clear-screen, and secure remote work standard
Disciplinary measures for policy violations

5. Secure Development

Milli follows a secure software development lifecycle, including threat modeling for significant features, mandatory peer code review, automated static analysis and dependency scanning, secrets scanning, separation of development, staging, and production environments, and change management with approvals and rollback plans.

6. Vulnerability Management

Continuous automated scanning of infrastructure, containers, and dependencies
Remediation targets measured from discovery: Critical within 7 days, High within 30 days, Medium within 60 days, and Low within 90 days
Timely patching of operating systems and third-party software
Coordinated handling of external reports through our Vulnerability Disclosure Policy

7. Penetration Testing

Milli commits to independent, third-party penetration testing of its applications, APIs, and cloud infrastructure at least annually and after any material change to its systems, as required by the Safeguards Rule. Findings are tracked to remediation, and retesting confirms fixes. Summary letters are available to financial institution partners on request.

8. Incident Response

Milli maintains a documented incident response plan, tested at least annually through tabletop exercises, with the following phases: 1. Detection and reporting: 24/7 automated alerting; any employee can escalate a suspected incident immediately. 2. Triage and classification: severity is assigned based on impact to customers, data, and operations. 3. Containment: affected systems are isolated and credentials rotated. 4. Eradication and recovery: root causes are removed and systems are restored from trusted sources. 5. Notification: customers, partners, regulators, and law enforcement are notified as required, including notification to the FTC within 30 days for qualifying events affecting 500 or more consumers, and to individuals as required by state law. 6. Post-incident review: lessons learned are documented and controls improved.

9. Third-Party Vendor Security

Before engaging any vendor that will access customer data or critical systems, Milli performs a risk-based due diligence review, including review of SOC 2 reports or equivalent security documentation, data protection and breach notification terms, and data minimization. Contracts require vendors to maintain appropriate safeguards, and vendors are reassessed at least annually.

10. Business Continuity and Disaster Recovery

Production data is replicated across multiple availability zones, backed up daily with encrypted backups, and restore procedures are tested at least annually. Recovery objectives are documented and reviewed.

11. Maintaining Our Security Posture

Milli continuously monitors its environment through centralized logging, security information and event management, endpoint detection and response, cloud configuration monitoring, and key risk indicators reviewed by leadership. Independent penetration tests and partner reviews validate that controls work as intended, and independent certification audits will do so as each certification in process is completed.

12. Contact

Security questions: security@drivemilli.com. To report a vulnerability, follow our Vulnerability Disclosure Policy.