Does Miles Mosaic keep a copy of my loyalty programme password?

No. Nothing connects to an airline or hotel account on your behalf, so there has never been a password of that kind for us to keep.

Has Miles Mosaic passed an outside security audit?

No third-party-audited security standard covers Miles Mosaic today, and no outside firm has published a review of these systems. See what we do not claim.

How are passwords stored?

Hashed, never in a form that could be read back or reversed. Signing in checks the hash against what you type, not a stored copy of the password.

How do I report a security problem?

Email info@milesmosaic.com or use the contact page. See report a security problem.

Security

What we store, how it is protected, and what a breach would actually yield

Not a badge and not a promise: an inventory. Every claim on this page traces to the code or configuration that makes it true, including the limits.

This page covers architecture and blast radius. For the six standing commitments in one place, see the trust centre. For the fuller policy and a look at tools that do link your accounts, see privacy.

What we store

These six are the main categories, not a hand-maintained inventory of every table: that kind of list goes stale the moment a table changes, silently. Each row names what it is, why it exists, and what it deliberately is not. For the fuller, per-domain answer tied to your own account, request the data export from Account settings (sign in required): it queries the live tables at request time, not this page.

Data	What it is	Why we keep it	What it is not
Account identity	Your name, email address, and a hashed password, or a Google sign-in link if you chose that instead.	To authenticate you and let you recover a lost sign-in.	A loyalty programme password. We never ask for one of those.
Trip and stay history	The flights and hotel stays you add yourself: dates, routes, hotel names, and any fare or rate you choose to enter.	It is the product. Status progress, forecasts and the dashboard are built from what you log.	A live feed pulled from an airline or hotel account. Nothing connects to one.
Loyalty balances and status, as you typed them	Membership numbers, point or mile balances and tier level, exactly as you last entered or updated them.	To show progress toward your next tier and put a value on the balance you already hold.	A real-time balance read from the programme. There is no login of ours to fetch one with.
Forecast inputs and results	The goal tier and assumptions behind a saved status projection.	So a forecast you ran once is still there next time you open the account.	Shared with, or derived from, the programme itself.
Billing identifiers	A Paddle subscription reference, a Paddle customer reference, and a plan code.	To know which plan an account is on and reconcile billing events.	A card number, an expiry date or a security code. Those go straight to Paddle.com Market Ltd and never reach a Miles Mosaic server.
A ticket you upload to the earning calculator	A boarding pass, confirmation email or itinerary file you upload there so its flight details can be read automatically.	To extract the fields you asked for, instead of you typing them by hand.	Kept afterwards. That endpoint removes the file at the end of the request that processed it, on every exit path: a normal finish, a caught failure, or a fatal error.

How it is protected

Eight properties, each traced to the code that enforces it rather than to a policy statement about it.

Passwords are hashed, never stored in a form that could be read back. Signing in checks the hash against what you type; the original text is never kept anywhere.
Session cookies are marked Secure, HttpOnly and SameSite=Strict. A script running on the page cannot read the session cookie, and it is never sent over a plain, unencrypted connection.
The site enforces HTTPS everywhere, with a two-year HSTS policy. A browser that has visited once refuses to fall back to plain HTTP even if a link points there.
Sign-in and password-reset attempts are rate-limited, by IP address and by account. Repeated failed attempts slow down and then block, which blunts automated password guessing.
State-changing requests carry a per-session token, checked before anything is written. A request forged from another site is rejected before it can act.
Admin and staff sign-in requires a second factor on top of a password. That currently covers the Miles Mosaic admin console. It is not yet offered on ordinary user accounts, and this page will say so plainly the day that changes.
Your payment details never reach Miles Mosaic. Paddle.com Market Ltd is Merchant of Record for every subscription and handles the card transaction directly; Miles Mosaic keeps a subscription reference, never a card number.
There is no loyalty credential in our database to protect in the first place. Miles Mosaic never links to an airline or hotel account on your behalf, and never keeps a copy of a loyalty programme password, because none is ever requested.

What an attacker would actually get

If the Miles Mosaic database were ever breached, here is the honest inventory, drawn from the table above: trip history, stay history, loyalty balances and status exactly as typed in, saved forecasts, and a hashed password that is not reversible to the original. Also a Paddle reference id, never a card number.

There is no way into any airline or hotel loyalty account, because there is nothing there to take: no password, no OAuth token and no active session for any programme exists in our database. Nobody could sign into an airline or hotel programme with what left in a breach, book a reward seat, transfer a balance, or redeem anything, because Miles Mosaic never held a credential that would let them.

That is a result of the architecture, not a policy that could quietly change. A tool built to sign into your programme automatically, so it can pull a balance without you typing it, necessarily holds something that opens that account: a stored password, a saved session, or an authorisation token. Miles Mosaic was built the other way around, with you as the only party who ever holds that credential, so there is no matching one for a breach to expose.

What we do not claim

No third-party-audited security standard covers Miles Mosaic today. If that matters to your own decision, weigh it as an open question, not a settled one.
No outside security firm has published a review of these systems. Nobody has been paid to try to break in and publish the results, as far as we can tell you.
Treat every statement above as something to check, not take on trust. Each one names the file or the setting that makes it true, the same way you would want a claim verified from any company with something to sell you.

Report a security problem

Found something wrong with any claim above, or a way around one of these protections? Email info@milesmosaic.com or use the form at the contact page, with enough detail that we can reproduce it. A person reads every message. We do not currently commit to a fixed response time or run a paid disclosure programme, and we will update this page plainly if that changes.

Questions about security

What would someone get if the Miles Mosaic database were breached?: Trip history, stay history, loyalty balances and status exactly as typed in, saved forecasts, and a hashed password that cannot be read back. See what an attacker would actually get.
Does Miles Mosaic keep a copy of my loyalty programme password?: No. Nothing connects to an airline or hotel account on your behalf, so there has never been a password of that kind for us to keep.
Has Miles Mosaic passed an outside security audit?: No third-party-audited security standard covers Miles Mosaic today, and no outside firm has published a review of these systems. See what we do not claim.
How are passwords stored?: Hashed, never in a form that could be read back or reversed. Signing in checks the hash against what you type, not a stored copy of the password.
How do I report a security problem?: Email info@milesmosaic.com or use the contact page. See report a security problem.