Security & Trust

We protect your data at every stage: • In transit: All connections to SafeCart are encrypted using TLS. Traffic over plain HTTP is redirected to HTTPS. • At rest: Databases, file storage, and backups are encrypted at rest by our infrastructure providers. • Secrets: Credentials, API keys, and tokens are stored as protected environment secrets, never in source code.

SafeCart is built on managed, enterprise-grade cloud infrastructure: • Supabase provides our PostgreSQL database, authentication, real-time services, and serverless edge functions, hosted in an EU region. • Vercel serves the web application over a global content delivery network with automatic HTTPS. • Stripe handles all payment and subscription data on its PCI-DSS Level 1 certified platform — SafeCart never stores full card details. Hosting within the EU supports data residency expectations and GDPR alignment.

Access to your data is tightly controlled: • Authentication is handled by Supabase Auth, with secure session management and token rotation. • Password strength is assessed at sign-up to discourage weak credentials. • Row-Level Security (RLS) is enforced on all database tables, so each account can only ever access its own data. • Our own team operates on a least-privilege, need-to-know basis, with production access limited to the minimum required.

Security is built into how we develop the product: • User-generated content is sanitised to prevent cross-site scripting (XSS) and injection attacks. • Inputs are validated and sanitised on both the client and server. • Requests are protected against cross-site request forgery. • Dependencies are monitored and audited for known vulnerabilities, and security linting is part of our workflow. • Code changes are reviewed before reaching production.

We design for durability and recovery: • Databases are backed up automatically on a regular schedule. • Backups are encrypted and retained on a rolling cycle. • Recovery procedures are documented so we can restore service with minimal data loss. • Critical infrastructure benefits from the redundancy of our cloud providers.

We keep a close eye on the health and security of the platform: • Application errors and performance are monitored continuously with Sentry. • Authentication and security-relevant events are logged for investigation. • Anomalous activity triggers alerts to our team so we can respond quickly.

If something does go wrong, we are prepared: • We maintain documented incident response procedures covering detection, containment, eradication, and recovery. • In the event of a personal data breach, we notify affected customers without undue delay and assist with their own notification obligations. • We conduct post-incident reviews to prevent recurrence.

Security and privacy go hand in hand: • SafeCart is designed to comply with the GDPR and EU ePrivacy rules. • We offer a Data Processing Agreement (DPA) for business customers. • We process data primarily within the EU/EEA and use Standard Contractual Clauses where transfers are necessary. • We use only essential cookies and do not track users across the web. SafeCart is a Silver Winner of the EU Product Safety Award — a reflection of our commitment to safety and trust.

We welcome reports from the security community. If you believe you have found a security vulnerability in SafeCart, please email [email protected] with the details and steps to reproduce. We ask that you give us a reasonable opportunity to investigate and remediate before any public disclosure, and that you avoid accessing or modifying other users' data. We will acknowledge your report and keep you informed of our progress.

We continue to invest in our security posture as we grow. Planned and ongoing initiatives include strengthening our formal policies, expanding security testing, and working toward recognised certifications (such as ISO 27001 readiness) as enterprise demand develops. If your organisation has specific security or due-diligence requirements, we're happy to talk them through.