Milora
Sign inGet started

Security & privacy

  • No institution passwords. Milora never asks for your brokerage or 401(k) login and never scrapes authenticated sites.
  • User isolation. Every user-owned database table enforces Row Level Security so you can only ever read your own rows.
  • Encrypted secrets. Your AI API key is encrypted on the server (AES-256-GCM) and is never sent back to your browser. Institution tokens use the same envelope.
  • Private uploads. Files go to private storage under your user folder. Before a document is sent to your AI provider, you give explicit consent. Retention is configurable.
  • Redact first. We ask you to hide account numbers and personal identifiers before uploading.
  • Read-only. Milora cannot place trades or move money.
  • Controls. Rate limits on APIs and AI usage, same-origin checks on state-changing requests, strict security headers and a Content Security Policy.
  • Your data, your call. Export everything as JSON or delete it from Settings.

Security is a process, not a claim of perfection. Report issues to the address listed in our security policy.