How we protect your data

Every table enforces row-level security in Postgres, so a query can only ever return rows belonging to the signed-in account. Isolation is enforced by the database itself, not by application code that could forget a filter.

Privileged database functions are execute-revoked from anonymous and authenticated roles, so they cannot be called directly from a browser.

All traffic is HTTPS, with HSTS set to two years and preload enabled, so browsers refuse to connect over plain HTTP. Data at rest is encrypted by our database provider.

Pages ship a strict Content Security Policy that restricts where scripts, styles, and connections may come from, plus frame-ancestors: none and X-Frame-Options: DENY to block clickjacking, X-Content-Type-Options: nosniff, and a Permissions-Policy that switches off camera and microphone access.

We never see or store your card details. Card data goes directly to Stripe and Razorpay, both PCI-DSS Level 1 service providers. We store only a customer reference and your subscription status.

Payment webhooks are cryptographically signature-verified and processed exactly once, so a replayed or forged webhook cannot change what you are charged or what plan you hold.

Authentication is handled by Supabase Auth. Passwords are hashed — nobody at SMAT Solutions Pvt Ltd can read yours. Admin tooling is restricted to a fixed allow-list of founder addresses and returns a 404, not a login prompt, to everyone else.

Crash reports are scrubbed of personal data before they leave your browser: emails, tokens, and other identifying values are stripped so diagnostics never carry your content.

Export works on every plan, including Free. Deleting your account removes your projects, tasks, calendar, and subscription records. Cancelling never deletes anything — extra projects become read-only and unlock again if you resubscribe.

Third parties that process data on our behalf are listed on our subprocessors page.

We are a small company and we are not going to pretend otherwise. We hold no SOC 2 or ISO 27001 certification, and we have not commissioned a third-party penetration test. If either becomes a requirement for you, tell us — it helps us prioritise honestly.

Email support@smatsols.com with "security" in the subject. We aim to acknowledge within two business days. Please give us reasonable time to fix an issue before disclosing it, and do not access data that is not yours while testing. We will not pursue legal action against good-faith research that follows those two rules.