Security

Last updated 15 August 2026

This page describes controls MELV actually has today, verified against the running system on 15 August 2026. Where we do not have something, it is listed as not having it rather than left out.

Transport

All traffic is served over HTTPS. TLS 1.3, certificate issued by Google Trust Services.
HSTS is sent on every response: max-age=31536000; includeSubDomains. We have deliberately not submitted the domain to the browser preload list — preloading is difficult to reverse, and we will not do it until every subdomain is confirmed HTTPS-only.
There is no mixed content. The Content-Security-Policy below forbids it structurally.

Browser-enforced policy

Every HTML, script and stylesheet response carries these headers:

`Content-Security-Policy`	Scripts may load only from our own origin. There are no inline scripts and no inline event handlers anywhere in the application, so `script-src` needs no `'unsafe-inline'` exception — which is where almost all of a CSP's value against script injection lives.
`frame-ancestors 'none'` `X-Frame-Options: DENY`	The application cannot be embedded in a frame on any site, which removes clickjacking.
`X-Content-Type-Options: nosniff`	Browsers may not second-guess a response's declared content type.
`Referrer-Policy: no-referrer`	No MELV URL is ever disclosed to an external site in a `Referer` header.
`Permissions-Policy`	Camera, microphone, geolocation, payment, USB and other powerful browser features are switched off by name, because the application does not use them.

Accounts and sessions

Passwords are stored as PBKDF2-HMAC-SHA256, 100,000 iterations, unique per-user salt. Plaintext passwords are never stored and never logged.
Minimum password length is 12 characters.
Session cookies are HttpOnly, Secure and SameSite=Lax, and are cryptographically signed.
Sign-in is rate limited to 10 attempts per minute per source address.
An administrator can invalidate a user's sessions immediately by bumping their session version; a password reset does the same.

Access control

Every record belongs to a tenant and a branch. Requests are scoped to both, and a user cannot read another tenant's data by changing an identifier in a URL.
Permissions are role-based — business developer, project manager, leadership, owner — and checked on the server for every request, never in the browser alone.
Changes to records are written to an append-only audit log recording who, what and when.
Photographs taken for condition reports are stored in private object storage and streamed through the application behind a session check. They have no public URLs.

Hosting and subprocessors

The application, database and file storage run on Cloudflare (Workers, D1, R2, KV). Cloudflare publishes its own security and compliance documentation; we do not restate their certifications as ours.
PhoneBurner processes outbound calling activity for customers who use it.
RentCast supplies public property-market data. It receives no customer data.
Transactional email (invitations and password resets) is sent through Cloudflare Email Sending. The sending domain publishes SPF, DKIM and a DMARC policy of p=reject.
There are no third-party analytics, advertising or session-recording scripts in the application. The Content-Security-Policy would block them.

Using MELV requires no software installation

MELV runs entirely in the browser. Normal use requires no downloads, no browser extension, no plug-in and no executable of any kind. Users may choose to export their own data as a CSV file; nothing is ever downloaded automatically.

What we do not claim

Stated plainly, because a security page that implies more than it has is worse than no security page.

MELV holds no SOC 2, ISO 27001, PCI DSS or HIPAA certification or attestation, and is not designed for protected health information or cardholder data.
We have not completed a third-party penetration test, and we do not run a bug bounty.
We publish no uptime figure and offer no uptime SLA.
Encryption at rest is provided by our hosting provider under their terms; it is not a control we implement or independently verify, so we do not present it as ours.

Reporting a vulnerability

Email security@getmelv.com. Please include enough detail to reproduce the issue. We will acknowledge within five business days. We will not pursue legal action against anyone who reports a genuine issue in good faith, gives us reasonable time to fix it, and does not access or modify data belonging to others.

Machine-readable contact details are published at /.well-known/security.txt.