Security
Last updated: 9 August 2026
On Facebook, you are the product. And once an association platform is hacked, it is the members' data that leaks. We intend to keep that number at zero.
Security at Membly
Membly is the secure digital home for associations. Your member data, conversations and documents belong to you — our job is to protect them. Here we explain in plain language what we actually do to prevent data leaks and breaches. Security is not something we added afterwards. It is built into Membly from the ground up, and we keep improving it.
Encryption — in transit and at rest
All traffic to and from Membly is protected with encryption (HTTPS/TLS). Nobody can eavesdrop on what is sent between your device and us, and we enforce secure connections (HSTS). All data is stored encrypted at rest with AES-256 in our database and file storage. The most sensitive data of all — for example the national identity numbers used for LOK reporting — additionally receives a further layer of field-level encryption with AES-256-GCM (authenticated encryption). Each association has its own encryption key, and those keys are in turn protected by a master key kept separately (known as envelope encryption). This means that even someone who against all odds gained access to the database could not read the most sensitive data.
Passwordless login
Membly uses passwordless login. You log in with a magic link sent to your email or with your Google account. Because we never store any passwords, there are no passwords that can leak, be guessed or be reused from other services. Even stricter requirements apply to our internal administration tool: mandatory two-factor authentication (TOTP), a locked list of who may log in, and an additional code verification before every sensitive action.
Strict access control and data isolation
Each association's data is isolated at database level with Row-Level Security (RLS) — a rule that applies to all of our tables. A member of one association can therefore never see another association's data, even if something were to go wrong higher up in the code. The protection sits in the database itself. We follow the principle of least privilege: you only see what your role (member, leader or administrator) is meant to see. The most sensitive tables — encryption keys and security logs — are entirely inaccessible to ordinary users and are reached only by trusted server code.
Payments
When your association receives payments, all card details are handled by Stripe, one of the world's leading payment providers (certified to PCI DSS Level 1). Card numbers never pass through Membly's servers and are never stored with us. Every message we receive from Stripe has its signature verified so that we know it is genuine, and duplicates are filtered out so that a payment is never processed twice.
Data minimisation and AI
We collect only the data needed for the service to work. We never sell your data and do not use it for advertising. When AI features are used, personal data is scrubbed before anything is passed on, and each association's data is kept isolated. Our AI providers do not train their models on your data. Personal data is also scrubbed from our error reports as far as is technically possible.
Protection against abuse
We have several layers that stop automated attacks and abuse: • Rate limiting slows down login attempts and other traffic that looks like abuse. • Security headers in the browser protect against common attacks — including clickjacking, content-type sniffing and insecure connections. • All incoming data is validated before it is processed, and file uploads are checked for file type and safe file names.
Logging and traceability
Sensitive events are logged so that they can be traced afterwards — for example when protected data is decrypted, when accounts are deleted and when administrators make changes. Security logs are retained for at least twelve months.
Backups and restoration
We take daily backups with 30 days' retention and regularly test that they can be restored. Should anything unexpected happen to data, we can recreate it.
Operations within the EU and our providers
Membly is operated within the EU (Ireland). The sub-processors we engage are carefully selected and bound by data processing agreements. For any transfers outside the EU/EEA, approved safeguards are used (the EU Standard Contractual Clauses or the EU-US Data Privacy Framework). The complete and always up-to-date list is available in our privacy policy and our data processing agreement.
Security review
We review Membly's security ahead of major releases — including access rules, payment flows, file uploads and APIs — and keep our technical dependencies updated and patched.
If something does happen
No service can promise that absolutely nothing can ever occur. That is why we have a documented incident plan. In the event of a personal data breach affecting an association, we notify it without undue delay — and at the latest within 72 hours — in accordance with the GDPR.
Get in touch or report a vulnerability
Have you discovered a vulnerability, or do you have questions about security? Get in touch at privacy@membly.app and we will take it very seriously. We appreciate responsible disclosure and respond as quickly as we can.
Language versions
This document was drafted in Swedish. The English translation is provided for convenience only. In the event of any discrepancy between the versions, the Swedish version governs.