Bank-grade security across every product in the ecosystem. Your data, your control.
TOTP-based 2FA shared across all products. Set up once, protected everywhere. Rate-limited to prevent brute force.
Bank-style 15-minute inactivity timeout with 60-second warning. Automatic sign-out protects unattended sessions.
AES-256 encryption at rest, and encryption in transit. TOTP secrets are stored on our servers and are never readable in the browser. Payment data never touches our servers (Stripe handles it).
Granular permissions: owner, admin, member, viewer. Role hierarchy prevents privilege escalation. Invites restricted by role level.
Complete audit trail of authentication events, subscription changes, and admin actions, with monitoring across every product.
Google Cloud Run with non-root containers. Secrets in Google Secret Manager. Helmet security headers. Global rate limiting.
MyAndGo uses Firebase Auth for identity, optional TOTP-based 2FA, bank-style session timeouts, role-based access control, and rate limiting on all sensitive endpoints.
Your content is stored in Google Cloud's Sydney region (australia-southeast1). See our Australian Data Residency page for details.
No. All payment processing is handled by Stripe. Card numbers, CVVs, and expiry dates never touch our servers.
Automated tests and dependency checks run in our build process.