MileIQ users trust us with their drives, their mileage, and the records behind their deductions and reimbursements. That trust is based upon us keeping that data both private and secure. The information on this page is intended to provide transparency about how we protect that data. We will continue to expand and update this information as we add new security capabilities and make security improvements to our products.
This overview describes MileIQ’s security practices; it is not an audit or certification report.
Security is a dedicated function within MileIQ. Our security team’s charter is to protect the data users store in our service. The team contributes to designing secure features, monitors and responds to security alerts, and periodically assesses our infrastructure and applications for vulnerabilities. Our security engineers continually evaluate new tools to increase the coverage and depth of these assessments and the security of our users’ data.
We monitor our systems and infrastructure for signs of suspicious activity or potential threats. We receive security alerts from a variety of sources. Each alert is promptly reviewed, and we take swift action to investigate, contain, and remediate any identified risks.
Access is limited to a least privilege model: our team members only have visibility on what’s required for them to carry out their jobs. Permissions are subject to internal assessment and monitoring to ensure they remain appropriate.
Security is built into how we develop and ship our products. Our software engineering team carefully reviews and tests code changes, and dependencies are monitored for known vulnerabilities. Our staging and production environments are logically separated.
Securing our Internet-facing services is critically important to protecting our users' data. Our security team drives an application security program to improve code security hygiene and periodically assesses our service for common application security issues. These assessments include independent penetration tests performed on a periodic basis by an external provider. Any findings that result from these assessments are tracked for remediation and addressed by following a risk-based approach.
At MileIQ, security is built into every step of our development process. For features that impact security, our dedicated security team is involved early, collaborating on design decisions and conducting focused, security-oriented reviews.
To ensure the security of our software supply chain, MileIQ uses tooling that continuously monitors and detects the use of vulnerable versions of dependencies. It scans our codebase to identify known security issues in open-source libraries and frameworks. When a vulnerability is detected, our engineering team is alerted promptly, allowing us to prioritize updates or mitigations as needed.
The MileIQ service runs on public cloud infrastructure. Our core product services run on Microsoft Azure, where they are orchestrated on Kubernetes, while Google Cloud supports our analytics and data processing.
MileIQ defines its network boundaries to control which services we expose to the Internet and to segment our production network from the rest of our computing infrastructure. Production is kept separate from our other environments, and public-facing and internal network paths are separated from one another. We limit who has access to our production infrastructure based on business needs.
All of our infrastructure resources, including those related to the network, are tracked and defined using infrastructure-as-code, so that our network configuration is managed consistently and changes go through review before they are applied.
MileIQ never stores users’ passwords in plaintext. Instead, we securely store a cryptographic hash, so that actual passwords remain protected even in the unlikely event of a breach.
You can sign in with Google or Apple, or with an email address and password. To help keep our users’ MileIQ accounts secure, when you use Google or Apple, you can sign in without creating or sharing a MileIQ-specific password.
When you receive an email from MileIQ, we want you to be confident that it really came from us. We publish an enforcing DMARC policy to improve your confidence that email you receive from MileIQ is legitimate. Every email we send from mileiq.com is cryptographically signed using DKIM and originates from an IP address we publish in our SPF record. We also publish a BIMI record, which allows supporting mail clients to display the MileIQ brand logo alongside our messages so they are easier to recognise. Mail clients decide whether to show that mark under their own policies, but together with DMARC, DKIM, and SPF it gives you a clearer signal that a message claiming to be from MileIQ genuinely is.
The MileIQ service is multi-tenant: many customers' accounts are hosted on shared infrastructure. Despite this shared platform, we treat each user's data as private — it is not accessible to other users, and we do not permit other users to access it unless the data owner explicitly shares it.
When storage that has held MileIQ data reaches the end of its life, it is retired through the secure-erasure processes of the public cloud providers we use, so that decommissioned storage does not expose users' data.
MileIQ uses industry-standard encryption to protect your data in transit. We force HTTPS for all of our services using TLS, so that traffic between your devices and our service is encrypted as it travels across the Internet. The TLS certificates that protect our services are managed centrally and renewed automatically.
Data that MileIQ stores is protected at rest by the built-in encryption features of the public cloud providers that host our service, so that information held on our cloud infrastructure is encrypted automatically.
MileIQ is deployed on public cloud infrastructure.
We operate a fault-tolerant architecture and configure our services to scale as load grows, so that MileIQ is available when users need it. We perform automated backups with point-in-time recovery, and we regularly back up users' content so that data can be restored if something goes wrong.
We have dedicated monitoring in place to spot downtime and promptly react to any kind of incident.
MileIQ runs on the infrastructure of established public cloud providers, Microsoft Azure and Google Cloud. These providers are responsible for the physical security of the data centers in which our service runs, including the controls that protect those facilities and the hardware inside them. We rely on their physical security programs to safeguard the infrastructure that hosts MileIQ data.
MileIQ understands the risks associated with improper vendor management. We evaluate and perform due diligence on all of our vendors prior to engagement to ensure their security and privacy practices meet a suitable standard. If they do not meet our requirements, we do not proceed with them.
We rely on a limited set of trusted service providers to help us operate MileIQ. Our current subprocessors, and the services each one provides, are published on our subprocessors page.
For users outside the United States, personal data is transferred to and processed in the United States.
Please see our Privacy Policy for more information about how MileIQ collects, uses, discloses, and safeguards personal information.