Security atStackovation.

Your project holds your ideas, your business data and often your customers’ data. We protect it with managed infrastructure, strict access rules and careful engineering. This page describes the measures we use.

• Client portal data is stored in a managed PostgreSQL database on Supabase, encrypted at rest.
• All traffic to the website and portal is encrypted in transit with HTTPS.
• Secrets and API keys are kept in environment configuration, never in source code.

• Row Level Security is enabled on every portal table, so each client can read only their own projects, comments and notifications.
• Staff access to client data is limited to named administrator accounts.
• We never store passwords in plain text — they are hashed by our authentication provider. You can also sign in with Google or GitHub.
• Sessions refresh automatically and you can sign out at any time.

We never store card numbers. Online payments are handled by PCI DSS–compliant payment providers, and only the amount, currency and status of each payment are recorded in your portal.

• Preview links are unlisted and shared only inside your portal.
• Previews run development builds for review. Please use test data, not real customer data, when trying them.
• You can ask us to take a preview offline at any time.

• Source code is kept under version control, with access limited to the people working on your project.
• We design against common web risks such as those in the OWASP Top 10 — validating input, using parameterised queries and giving each part of the system only the access it needs.
• Dependencies are kept up to date and checked for known vulnerabilities.
• Production credentials are handed over to you at launch, and you can rotate them at any time.

If we discover a security incident affecting your data, we will contain it, investigate, and notify affected clients without undue delay. We report incidents to CERT-In and the Data Protection Board of India where the law requires.

If you find a security issue in our website or portal, please use our contact form or email hello@stackovation.com, and include the steps to reproduce it. When testing:

• Do not access, change or delete data that is not yours.
• Do not run denial-of-service, spam or social-engineering tests.
• Give us reasonable time to fix the issue before sharing it publicly.

We will acknowledge your report, keep you updated, and not take legal action over research done in good faith within these rules.