Security at MOVO

MOVO is a private messenger with built-in payments, marketplace, and community spaces. Security is not a feature we bolted on — it is how we architect the product. This page describes the controls we run today, the ones we are actively building, and how to reach us if you find a problem.

Nothing on the public internet is unbreakable. We publish this page so you can see the trade-offs we make and hold us to them.

All traffic between the MOVO apps, the movochat.com web surfaces, and our backend is served over TLS 1.2 or TLS 1.3 with modern cipher suites. HTTP is redirected to HTTPS at the edge. HSTS is enabled on the marketing and investor domains.

Internal traffic between services in our cluster is also TLS-terminated. We do not run any plaintext internal APIs.

Any one-to-one chat can be upgraded to Secure Mode. When Secure Mode is enabled, message content is encrypted on the sender's device with a key that only the recipient's device can unwrap. MOVO servers see the ciphertext and the routing metadata; we cannot read the content and cannot recover it if you lose your device.

Regular (non-Secure) chats are stored on our servers so they can sync across your devices. This is a deliberate trade-off between convenience and privacy; you choose per chat.

Sensitive columns in our primary database are encrypted at the field level with keys managed outside the application tier. Full-disk encryption is enabled on all database, cache, and object-storage volumes. Backups are encrypted end-to-end and access-controlled.

MOVO operates a tiered KYC (Know Your Customer) and AML (Anti-Money-Laundering) program that scales with what a user is trying to do. Basic messaging needs no identity verification. Deposits, withdrawals, and marketplace transactions above defined thresholds require progressively stronger checks.

• Identity verification — government-issued photo ID (passport, national ID, driver's licence) plus a live selfie check.
• Address verification — recent utility bill, bank statement, or equivalent, for higher tiers.
• Source-of-funds review — for the highest tiers and for flagged transactions.
• Sanctions and PEP screening — every KYC record is screened against global sanctions and politically-exposed-persons lists at onboarding and on an ongoing basis.
• Transaction monitoring — pattern-based alerts feed a manual review queue staffed by the MOVO compliance team.

MOVO uses a self-custodied HD (hierarchical-deterministic) wallet model for all user-held crypto. Private keys are generated on your device, encrypted at rest with a key derived from your device biometrics and a device secret, and never leave the device in plaintext.

MOVO cannot move your crypto without your device. MOVO cannot recover your crypto if you lose your device and your recovery phrase. If you use the MOVO wallet, back up the recovery phrase somewhere durable and offline.

Deposits into MOVO Wallet and marketplace escrow use platform-controlled hot wallets that are segregated per environment, rotate keys on a schedule, and are backed by a cold-storage reserve for large balances.

MOVO accounts are anchored to a verified phone number. Sign-in on a new device requires a one-time code delivered by SMS via our provider Prelude, or by email via Mailgun where SMS is unavailable.

• Biometric confirmation is required for every payment above a small threshold on iOS and Android.
• Trusted-device controls surface every active session; you can revoke any of them from Settings.
• Login alerts are pushed to your other devices whenever a new sign-in succeeds.
• Short-lived access tokens paired with rotating refresh tokens; access tokens expire in minutes, not days.
• Rate limiting and progressive-friction challenges guard the sign-in flow against automation.

MOVO runs on DigitalOcean managed Kubernetes with DigitalOcean Spaces for object storage and a hardened Postgres primary. Access to production is gated by short-lived credentials, MFA, and IP-restricted admin surfaces. Engineers do not have standing production database access; every production query is audit-logged.

Secrets are stored in a dedicated secrets manager. No secrets are committed to source control, and our CI pipeline blocks builds where a secret-scan hit is detected.

MOVO maintains an on-call rotation and a written incident-response runbook. When we confirm a security incident, we follow a defined path — detect, contain, eradicate, recover, learn — and record it in an internal post-mortem.

If an incident affects user data, we notify affected users and, where applicable, the relevant regulator within the deadlines set by local law (72 hours under GDPR). A public post-mortem is published for material incidents once the investigation concludes and disclosure is safe.

If you believe you have found a security vulnerability in MOVO, please tell us before you tell anyone else. Email security@movochat.com with a description, reproduction steps, and any proof-of-concept material.

• Please do not test against real user accounts other than your own.
• Please do not exfiltrate more data than the minimum needed to demonstrate the issue.
• Please do not publicly disclose until we have had a reasonable window to fix (typically 90 days).
• We will acknowledge your report within two business days and give you a status update within seven.
• We will credit you in the fix notes if you would like, and will never take legal action against a good-faith researcher acting within this policy.

A formal, paid MOVO bug bounty is coming soon. Until it launches, we still welcome responsible-disclosure reports at security@movochat.com and will recognise substantive findings publicly with your permission.

For security issues, always use the dedicated inbox — it is monitored by the security team on a 24/7 rotation.

• Security disclosures: security@movochat.com
• General support: support@movochat.com
• Website: https://movochat.com