SaathiX URL runs on Lovable Cloud (built on Supabase and Cloudflare). The application is served from edge locations worldwide for low latency, with the primary database hosted in a hardened, ISO 27001-certified data centre. Production environments are isolated from development and staging; only authorised, MFA-protected staff accounts can deploy.

• In transit, every request uses HTTPS with TLS 1.2+ (TLS 1.3 preferred) and HSTS. Plaintext HTTP is redirected.
• At rest, database volumes and object storage are encrypted with AES-256.
• Secrets, API keys and tokens are stored in a managed secrets vault and never committed to source control or written to application logs.

• Sign-in supports email + password and 6-digit email OTPs sent from notification@saathixurl.online.
• Passwords are hashed with bcrypt / argon2 by Supabase Auth, we never see your plaintext password.
• Sessions use short-lived access tokens and rotating refresh tokens; you can revoke active sessions from your dashboard.
• Forgotten passwords are reset only after a fresh OTP is verified.

Every tenant table enforces PostgreSQL Row-Level Security (RLS) so a signed-in user can only read and write data that belongs to them. Privileged backend operations run through verified server functions; the service-role key is never exposed to the browser.

• Input validation with Zod on every server function.
• Output escaping by React; we avoid dangerouslySetInnerHTML except for trusted, sanitised content.
• Strict Content-Security-Policy and security headers via Cloudflare.
• Automated dependency scanning and weekly patching of high/critical CVEs.
• Rate limiting and bot mitigation on auth and OTP endpoints.

• Database backed up daily with point-in-time recovery for the last 7 days.
• Object storage is replicated across multiple availability zones.
• Disaster-recovery procedures are tested at least once a year.

We monitor logs, error rates and authentication events 24×7. If we detect a security incident affecting your data, we will notify you without undue delay and within statutory timelines (e.g. 72 hours under GDPR), describe the impact and the steps we are taking.

Payments are processed by PCI-DSS certified providers (Razorpay / Stripe / Paddle). SaathiX never stores raw card numbers or bank credentials.

If you discover a vulnerability, please report it privately so we can fix it before it is exploited.

• Email security@saathixurl.online with reproduction steps.
• Do not test on real user data, do not perform DDoS, do not publicly disclose the issue before we have responded.
• We acknowledge within 24 hours, triage within 5 business days and credit researchers (with consent) in our hall of fame.
• Good-faith research within these rules will not lead to legal action.

Security is a partnership. You can help by using a strong unique password, enabling 2FA on your email account, keeping recovery details up-to-date and reporting suspicious activity to security@saathixurl.online.