Security overview

Security is part of the product

Milli designs its financial operating system around protecting access, limiting unnecessary data use, and keeping product boundaries clear. Security practices evolve as Milli adds products, partners, and ways for drivers to manage their financial picture.

Account access protection

Milli works to protect the paths used to access the site and product. Use the access controls offered in the product, keep credentials private, choose a strong and unique password when a password is used, and review account activity when it is shown. Milli will not ask you to share a password or one-time security code through an unsolicited message.

If you believe someone may have accessed your account, use the support path available in the product as soon as possible. Milli may need information about the event to investigate and help protect the account.

Least privilege and data minimization

Milli’s security program follows least-privilege and data-minimization principles. Access to information should be limited to the people and systems that need it for an authorized purpose, and Milli aims to collect and retain information that supports a real product, operational, or legal need.

Different Milli products may use different systems and permissions. A feature’s access does not automatically mean every Milli team or partner can access every part of your financial picture.

Partner boundaries

Checking, Tax Vault, card, retirement, investment, and other financial experiences may involve banking, brokerage, card, or other product partners. Each partner is responsible for the systems and obligations assigned to it, and its own terms and privacy or security notices may apply. Milli works to keep those boundaries understandable when a product moves between Milli and a partner.

Monitoring and response

Milli reviews operational signals and reports that may indicate misuse, account risk, or a service issue. When Milli identifies a concern, it works to contain the issue, understand what happened, restore the affected experience, and communicate through an appropriate channel when notice is required. Response steps depend on the nature and scope of the event.

Your part in security

Use a private device when possible, keep your operating system and browser current, protect your credentials, and be cautious with links or messages that ask for financial or account information. Review the destination before entering information. Report suspicious activity through the support path available in the product.