Security
Your store, your margins and your customers' phone numbers are sensitive. These are the safeguards in place today, mapped to Rule 6 of the DPDP Rules, 2025 (encryption, access control, logging, continuity and contractual controls).
Encryption
- Every connection to the app and between our servers and the database uses TLS; browsers are told to use HTTPS only (HSTS).
- The database is encrypted at rest (AES-256) by our database provider.
- Credentials for your connected accounts (store tokens, API keys) are encrypted again with AES-256-GCM before storage, and are never shown back in full.
Sign-in and sessions
- Passwords are hashed with PBKDF2-SHA256 at 600,000 iterations (OWASP guidance) and a unique salt, and can't be read by anyone, including us.
- Sign-in attempts are rate-limited per account and per network address.
- Sessions are HTTP-only, secure, same-site cookies that expire after 14 days, and are checked against the account on every request, so removing a login, resetting or changing a password signs that person out everywhere.
Access control
- Every request is tied to one brand, and every query that reads data is limited to that brand.
- Roles: owners and admins can change settings and export contacts; view-only users can't export or change anything.
- Suprfree staff access a brand only through a logged switch; every switch, export, erasure, sign-in and password change is written to an audit log kept for at least a year.
Application protections
- A strict Content Security Policy: the app loads scripts, styles, fonts and images only from itself.
- Changes can only come from the app's own pages (cross-site request protection), and the app can't be framed by other sites.
- Spreadsheet exports neutralise formula injection. Error pages never show internal details.
- Incoming webhooks are verified by signature before anything is read.
Data minimisation and retention
- We store only the customer fields reports, delivery support and messaging need. Customer keys that link orders are one-way hashes, and an erasure clears the name, number and address from every order as well as from the customer record.
- Automatic daily deletion: abandoned-checkout contacts after 90 days, message phone numbers and text after 180 days, customers inactive for three years.
- Erased people are remembered only as a salted hash, so an import or sync can't bring their details back.
Operations
- Hosting and database in Singapore on providers with SOC 2 Type II reports.
- Dependencies are pinned and reviewed on update. Connector API versions are tracked and renewed before providers retire them.
- Personal data breaches are reported to affected brands without undue delay and to the Data Protection Board of India within 72 hours.
Reporting a vulnerability
Found a security issue? Email support@suprfree.com with the steps to reproduce. Please don't access data that isn't yours or disrupt the service. We'll acknowledge within two business days and keep you updated until it's fixed.