Trust
Security & Trust
A plain-language look at how we protect your data. This page is a summary -- for the complete, formal policy, see our Data Security Policy.
Infrastructure
BittuAI is built on Supabase, a managed platform on top of Postgres. Your data lives in a production-grade database with automated backups, rather than a bespoke, self-managed server stack.
Encryption
All traffic between your browser and our servers is encrypted in transit (HTTPS/TLS). Data at rest in our database and file storage is encrypted as well, using the encryption Supabase provides by default.
Access control: tenant isolation
We use Postgres Row-Level Security (RLS) on every table. In plain terms, this means the database itself -- not just our application code -- enforces that one workspace's data can never be read or leaked by another workspace. This is a real, already-built protection, not a future promise. The same isolation extends to agencies managing multiple client workspaces: each client's data is walled off at the same database level, from the agency's own workspace and from every other client in it.
Payment security
Payments run through Cashfree, a PCI-DSS certified payment processor. BittuAI never sees, transmits, or stores your raw card number -- Cashfree handles that directly.
Certifications
We are not yet SOC 2 or ISO 27001 certified. Formal certification is on our roadmap, and we'll update this page as that work is completed.
Staff access & authentication
Internal access to production data by our own team is limited to what's needed to operate and support the service, on top of the role-based permissions your workspace sets for its own users. In the interest of stating things plainly rather than implying more than is true: we don't yet offer multi-factor authentication (MFA) or single sign-on (SSO) for customer accounts. If your workspace has specific authentication requirements, talk to us before you sign up.
Backups & disaster recovery
We rely on Supabase's managed database backup capabilities, and we're formalizing our own backup-verification and disaster-recovery process. We're not publishing a specific recovery time or recovery point objective on this page until we have real operational evidence to back a number -- an honest "in progress" beats a number we can't yet stand behind.
Incident response
We maintain an internal process for investigating and responding to suspected security incidents. If a breach affects your personal data or content, we'll notify affected customers without undue delay, in line with our legal obligations -- we're not committing to a specific fixed notification window (like a set number of hours) until we've confirmed we can consistently meet one.
Each of these is an active priority as we scale, not a static gap -- we'll update this page the moment any of them changes.
Data retention
We keep customer and account data for as long as your account stays active, and as needed to meet our legal, tax, and accounting obligations. If you close your account, active data is removed from production systems within a reasonable period; it may persist briefly in encrypted backups until those backups naturally cycle out.
Report a security issue
Found a vulnerability? We don't run a formal bug bounty program yet, but we do want to hear from you. Email subhash@sahinov.in with details, and we'll respond directly.
Want the full detail?
Our Data Security Policy covers data handling, retention, incident response, and sub-processors in complete, formal terms. If your compliance or procurement team needs a completed security questionnaire before signing off, email subhash@sahinov.in and we'll fill it out directly rather than leaving it to a form.
Read the Data Security Policy