Security

Last updated 20 August 2026.

This page describes how the service is actually built, not a list of reassuring adjectives. It holds records people file tax returns from, so the specifics matter.

Your password

Passwords are handled entirely by Google Firebase Authentication. Yours is never sent to our own servers, never written to our database, and cannot be read by us or recovered for you — if you forget it, you reset it.

Staying signed in

Signing in gives your browser a session cookie that JavaScript on the page cannot read, sent only over HTTPS. Every request that loads your data verifies that cookie against Firebase on the server before a page is built — so a page you are not entitled to see is never sent to your browser in the first place.

Sessions are checked for revocation on each request, so disabling an account or signing out everywhere takes effect immediately rather than whenever the cookie happens to expire.

Keeping accounts apart

Every read and write is scoped to the account that made the request, taken from the verified session — never from anything the browser sends. Editing or deleting a trip re-checks that it belongs to you, and answers identically whether a trip does not exist or belongs to someone else, so the system cannot be probed for which records are real.

Database security rules independently close the same doors. Subscription state is kept in a separate collection that the browser can read but never write — otherwise a subscription could be granted from a browser console.

Payments

Card details go directly to Stripe and never touch our servers. We store only a customer reference and your subscription status. Payment events arriving from Stripe are cryptographically verified before anything is recorded, and applied once even if delivered twice.

In transit and at rest

Everything is served over HTTPS with HSTS. Data is stored in Google Cloud Firestore, which encrypts at rest. Reports are served with cache headers that keep them out of shared caches — a tax record has no business sitting in a proxy.

Location

There is nothing to secure here, because there is nothing collected: no GPS, no background location, no app on your phone. The postcodes you type are the whole record.

What we ask of you

• Use a password you have not used elsewhere.
• Turn on two-factor authentication for the email address on your account — it is the way back in if you lose your password.
• Tell us promptly if you think someone else has access.

Reporting a vulnerability

If you have found a security problem, please tell us at office@miletallypro.co.uk before disclosing it publicly, and give us a reasonable chance to fix it. Include enough detail to reproduce it. We will acknowledge within three working days and keep you posted.

We will not pursue legal action over good-faith research that avoids privacy violations, data destruction and service degradation. Please do not access other people’s accounts or data — a proof of concept against your own account is enough.

If something goes wrong

If a breach affects your personal data, we will tell you and, where required, the Information Commissioner’s Office within 72 hours of becoming aware of it. What we hold and for how long is set out in the privacy policy.