Security at Monely

How your data is protected and how to report a vulnerability.

This page brings together, in one place, the security practices already in force at Monely and the path for telling us about a flaw. It complements the Privacy Policy, which describes which personal data we process and for what purpose.

Encryption

In transit: communication between the app, the website and our servers runs over HTTPS/TLS.
At rest: stored data is encrypted using the mechanisms provided by the storage infrastructure itself.

One clarification, so there is no misunderstanding: Monely does not use end-to-end encryption.

Authentication and sessions

The identity of anyone signing in to Monely is verified by Firebase Authentication, from Google. There are four ways to sign in:

Google account;
Apple account;
one-time code sent by email;
one-time code sent by WhatsApp.

After signing in, every request to our API travels with a session token in JWT format, valid for 30 minutes. Renewal uses a secure rotation mechanism, so an intercepted token has only a short window of usefulness.

App integrity

Monely uses Firebase App Check to confirm that requests come from a legitimate installation of the app rather than a forged client. Verification relies on Play Integrity on Android and App Attest on iOS.

Rate limiting

API endpoints are rate limited. That limit reduces the surface available for brute-force attempts, automated scanning and abusive usage.

Personal data, LGPD and GDPR

Personal data is processed in accordance with the LGPD, in Brazil, and the GDPR, in the European Union. Data subject rights, including access, correction, portability and deletion, are handled through the channels described in the Privacy Policy. To close your account and erase your data there is a dedicated path, with step-by-step instructions, at delete account and data.

How to report a vulnerability

If you have found a security flaw in the app, on the website or in the API, write to contato@monely.app with the word Security in the subject line. This page is the responsible disclosure policy referenced by the Policy field of /.well-known/security.txt.

Every report is read and assessed individually, and reports sent in good faith are welcome.

The scope of this page

The text above describes practices in force on the date shown below. It is not a certification, a seal or a third-party audit. When one of these practices changes, the change shows up here.

Page updated on 10 August 2026.

Discover Monely