Security

• HTTPS/TLS enforced for all traffic, with a strict Content-Security-Policy and Permissions-Policy.
• Row-level security on every application table; entitlements enforced server-side, not in the browser.
• Privileged database functions isolated in a private schema with no anon or authenticated execute grants.
• Managed authentication (email magic link and Google) with short-lived tokens; no passwords stored by us.
• Payment card data handled entirely by Stripe — card numbers never reach our servers.
• Dependency scanning with prompt patching of known-vulnerable packages.

These are planned. Treat none of them as a current assurance.

• SOC 2 Type II audit — not started; no report exists today.
• Formal GDPR alignment review and records of processing.
• SAML SSO and SCIM provisioning for Enterprise plans.
• Third-party penetration test with published summary.
• Bug bounty programme with monetary rewards.

Email security@startups.bd with reproduction steps and impact. We acknowledge within 3 business days and aim to remediate high-severity issues within 30 days.

• Test only against your own account and data.
• No denial-of-service, spam, social engineering, or physical attacks.
• Give us reasonable time to fix before public disclosure.

We credit reporters who follow this policy. We do not currently pay bounties.

Confirmed incidents affecting personal data are investigated immediately and notified to affected account holders and, where required, regulators without undue delay.