Every firm's data sits in its own dedicated database, isolated from every other firm on the platform. Isolation is enforced in the data layer itself rather than in the application, so it holds regardless of how the data is reached.

Firms whose requirements call for a fully separate environment are provisioned one. We will walk your compliance team through the specifics under NDA.

Yes. Milemarker supports single sign-on against Microsoft Entra ID, Google Workspace and Okta, so your people sign in with the credentials they already have.

Your identity provider remains the system of record. Joiners and leavers are handled in the directory you already run, which means there is no separate Milemarker user list to maintain or to remember to deprovision when someone leaves. Multi-factor authentication and role-based least privilege are enforced on every session.

Yes. Where a firm has a residency obligation, we provision a dedicated environment in the jurisdiction that obligation requires.

Residency is a property of the environment rather than a setting, so it is scoped with you as part of implementation. Bring it up early and we will plan for it from the start.

Yes. Milemarker offers SEC 17a-4 recordkeeping with WORM retention and an irrevocable retention lock, for broker-dealers who need it.

We also provision dedicated environments built to meet HIPAA and other regulatory regimes, so a firm with obligations beyond the standard deployment is not forced to choose between its platform and its mandate. Tell us the regime you are held to and we will scope the environment that satisfies it.

Permissions are enforced in the data layer rather than in the interface, so a user sees the same permitted set no matter how they reach the data. Access is scoped by role — by advisor, office or team — and fields carrying personal information are masked from users who are not entitled to see them.

Your configuration is set up with you during implementation, and we will review it with your compliance team under NDA.

Yes. Milemarker is penetration tested, and remediations are retested to confirm they hold rather than closed on assertion.

Results are available to clients and prospective clients under NDA, alongside the SOC 2 Type II report.

The data is yours. That is stated in our terms, not just our marketing.

You can export it in full, in standard formats, at any point during the relationship and on exit — not a report of it, the data itself. The platform and the engineering that normalizes and governs it remain Milemarker's; the data footprint is yours to take with you.

Milemarker's terms commit us to notifying affected clients within 72 hours of confirming a breach involving their data.

Notification goes to the contacts your firm designates, and we coordinate directly with your compliance team throughout the response.