Security

1.Every workspace is separate

Each agency’s data is stored with its workspace identifier, and the database itself enforces that a request can only read and write rows of the workspace it belongs to (row-level security). A bug in a page cannot, by itself, show one agency another agency’s data. Client users see only their own client’s portal.

2.Encryption

• In transit: all traffic uses HTTPS (TLS).
• At rest: the database and file storage are encrypted by our infrastructure provider.
• Vault secrets and integration keys: additionally encrypted by the application before they are stored, and shown only when someone with permission presses reveal. Every reveal is written to an audit log.

3.Access control

• Roles (owner, admin, manager, member, client) decide what each person can see and change; the server checks it on every request, not just the interface.
• Passwords are never stored in readable form. Sign-in attempts are rate-limited, and you can sign out of all devices.
• Owners can see who signed in and what changed in the audit log.
• Our own staff access production data only to support a request or fix a fault.

4.AI features

Text is sent to an AI model provider only when someone presses an AI feature. It is not used to train models, and providers are listed in the Data processing summary. Nobody sees another workspace’s content through an AI feature.

5.Payments

Card and UPI details are entered on Razorpay’s hosted checkout. They never touch our servers.

6.Hosting and backups

The database and files run on Supabase in Tokyo, Japan; the application runs on Vercel. The database is backed up automatically by the provider, and we can restore a workspace after an accident. Sub-processors are listed in the Privacy policy.

7.If something goes wrong

We investigate every report, fix, and tell affected workspaces without undue delay with what happened and what to do. The breach-notice commitments are in the Privacy policy.

8.Report a vulnerability

Found something? Email pinnaklemedia@gmail.com with steps to reproduce. Please do not access other people’s data, run denial-of-service tests or publish details before we have fixed it. We reply within two working days and will credit you if you wish.

This page describes our practices in plain words; it is not a certification. We have not yet completed a third-party audit such as SOC 2 or ISO 27001, and we will say so here when that changes.