Data Security Policy
1. Overview
This Data Security Policy describes the technical and organizational measures Sahinov Pvt Ltd uses to protect data processed by BittuAI. It is written to state plainly what is and is not yet in place, rather than imply a level of maturity we have not yet reached. It supplements, and should be read alongside, our Privacy Policy and Terms of Use.
2. Infrastructure & Hosting
BittuAI is built on Supabase, which provides our Postgres database, authentication service, and file storage. Supabase’s infrastructure runs on established cloud providers with their own physical and network security controls. We do not operate our own data centers.
3. Encryption
Data is encrypted in transit using TLS between clients, our application, and Supabase. Data at rest in our Postgres database and file storage is encrypted using Supabase’s underlying storage-level encryption.
4. Access Control Model
Customer data is isolated by workspace using Postgres Row Level Security (RLS) policies enforced at the database layer, so a query can only return rows belonging to the workspace the requesting user belongs to. Within a workspace, access to features and data is further scoped by role-based permissions. Internal access to production data by Sahinov Pvt Ltd personnel is limited to what is needed to operate and support the Service.
5. Authentication & Account Security
User authentication is handled by Supabase Auth, using industry-standard password hashing and session management. As of the date of this policy, BittuAI does not yet offer multi-factor authentication (MFA) or single sign-on (SSO) — we are stating this plainly rather than implying either exists today. Customers with specific authentication requirements should contact us to discuss their needs.
6. Payment Security
Payments are processed by Cashfree, a PCI-DSS compliant payment processor. Card and other payment instrument details are entered directly into Cashfree’s interfaces and never pass through or are stored on Sahinov Pvt Ltd’s own servers. We retain only payment metadata (plan, amount, currency, transaction ID, status, and a masked card summary) as needed for billing and support.
7. Sub-processor List
| Sub-processor | Purpose |
|---|---|
| Cashfree | Payment processing and billing |
| Supabase | Database, authentication, and file storage infrastructure |
8. Data Retention & Deletion
We retain customer and account data for as long as an account remains active and as necessary to meet our legal, tax, and accounting obligations. On account closure, active data is deleted from production systems within a reasonable period; data may persist temporarily in encrypted backups until those backups naturally cycle out. See our Privacy Policy for more on retention from a personal-data perspective.
9. Backup & Disaster Recovery
We rely on Supabase’s managed database backup capabilities. We are formalizing our own documented backup verification and disaster-recovery process and are not publishing a specific recovery time objective (RTO) or recovery point objective (RPO) on this page until we have real operational evidence to back a specific number — backup practices are being formalized rather than committed to a figure we cannot yet stand behind.
10. Incident Response & Breach Notification
We maintain an internal process for investigating and responding to suspected security incidents. In the event of a data breach affecting your personal data or Customer Content, we will notify affected customers without undue delay, in line with our obligations under applicable law. We are not committing to a specific fixed notification window (such as a set number of hours) on this page until we have confirmed our real operational capability to consistently meet one.
11. Vulnerability Management
We apply security patches and dependency updates to our own application code on an ongoing basis and rely on Supabase and Cashfree to secure their respective platforms. We have not yet established a fixed, recurring third-party penetration-testing cadence, and we are stating this honestly rather than implying a testing program that does not yet exist. Security researchers who identify a vulnerability can report it using the contact details in Section 14.
12. Compliance & Certifications
Sahinov Pvt Ltd is not currently SOC 2 or ISO 27001 certified. We rely on our infrastructure sub-processors’ own compliance postures (Supabase and Cashfree each publish their own security and compliance information) in addition to the measures described in this policy. We will update this section if and when we pursue a formal certification.
13. Customer Responsibilities
Security is a shared responsibility. As a customer, you are responsible for:
- Keeping your account credentials confidential and using a strong, unique password;
- Controlling which members of your workspace have access to your BittuAI account and at what role/permission level;
- Only uploading content you have the rights to use; and
- Promptly notifying us if you suspect unauthorized access to your account.
14. Contact for Security Reports
To report a suspected vulnerability or security incident, contact subhash@sahinov.in. Please include enough detail for us to reproduce and assess the issue; we will acknowledge reports as promptly as we can.