Security

1. One business cannot see another's data

This is the guarantee everything else rests on. Isolation is enforced in the database itself with row-level security, not in application code.

That distinction matters: if a developer forgets a filter in a query, the database still returns nothing that belongs to another workspace. A bug in our code cannot turn into a data leak between customers.

2. Roles are enforced on the server

Owner, Manager, Team Lead and Sales each see a defined slice of a workspace. A salesperson sees only leads assigned to them; a team lead sees their team.

These checks run server-side and in database policies, so changing a URL, editing a request or opening developer tools does not widen what you can read. Hiding a button is not access control, and we do not treat it as such.

3. Authentication

Sign-in is handled by Supabase Auth. Passwords are stored only as salted hashes — nobody at AbhiKai can read your password, and we cannot email it to you.

Sessions use httpOnly cookies with short-lived access tokens and rotating refresh tokens. Email verification is required before a workspace becomes usable, and signup and login are protected by a bot check.

4. Encryption

All traffic runs over TLS — the application is HTTPS-only, with HTTP upgraded automatically. Data at rest is encrypted by our infrastructure providers, including database storage and backups.

Files you upload live in a private bucket with no public URL. They are reached only through short-lived signed links generated for an authorised user, so a copied link stops working.

5. Payments

Card details never reach our servers. Checkout is hosted by Razorpay, a PCI-DSS compliant gateway, and we receive only a payment reference and status.

Payment webhooks are signature-verified and processed idempotently, so a replayed or duplicated notification cannot double-charge you or double-credit an account.

6. Secrets and access on our side

Service keys and API secrets are server-side only and never shipped to the browser. They are held as environment secrets, not in source control.

Access to production is limited to the people who need it, and administrative actions inside a workspace are recorded in an audit trail you can read.

7. Backups and recovery

The database is backed up automatically with point-in-time recovery, so we can restore to a moment before an incident rather than to last night.

Deleting your account keeps data recoverable for 30 days in case it was a mistake, after which it is removed from live systems and ages out of backups.

8. What we have NOT done yet

We would rather you learn this here than in a procurement questionnaire. As of today AbhiKai does not have:

• A SOC 2, ISO 27001 or any third-party security certification — none are in progress, and any vendor list requiring one should rule us out today.
• A published contractual uptime SLA on self-serve plans.
• An independent penetration test report we can share.
• Two-factor authentication for user logins — it is on the roadmap and is our most requested security item.
• Single sign-on, SCIM provisioning or IP allow-listing.
• A guarantee that all processing stays inside India — some processors operate globally under contractual protections.
• If any of these is a hard requirement for you, tell us before you commit and we will give you a straight answer rather than a maybe.

9. Reporting a vulnerability

If you find a security issue, email us with Security in the subject line. We read those the same day. Include what you found, how to reproduce it, and how you would like to be credited.

Please test only against a workspace you own. Do not access another business's data, do not run load or denial-of-service tests, and give us a reasonable chance to fix an issue before publishing it. We will not pursue anyone acting in good faith within those limits.

10. Your part in it

Most real-world breaches are not clever attacks. A few habits cover the majority of the risk:

• Give each person their own login rather than sharing one — it costs nothing extra.
• Use the lowest role that lets someone do their job.
• Remove people the day they leave, and reassign their leads.
• Use a unique password, ideally from a password manager.
• Be careful which platform accounts you connect, and disconnect the ones you stop using.