Authentication. Sign-in is handled by Supabase Auth, with passwords stored as salted hashes we never see in plain text.

Encryption. All traffic to and from Quantum Accord is encrypted in transit via TLS. Data at rest is encrypted by our infrastructure providers (Supabase/Postgres, Vercel).

Data isolation. Every project is scoped to your account with database-level Row Level Security — the database itself enforces that you can only ever read or write your own rows, not just the application code.

Payments. We never store card, UPI, or bank details. Payments are processed directly by Stripe and Razorpay, both PCI-DSS compliant payment processors, and webhook signatures are verified before we trust any payment event.

Least privilege. Server-side operations that need elevated database access (like payment webhooks) use a separate service key that stays on the server and is never exposed to the browser.

Your side. Your sign-in, who you share access with, and your own copy of the site stay with you. Where your website actually lives explains the split and has a ten-minute check.

Reporting an issue. If you believe you've found a security vulnerability, please email support@quantumaccordbg.com with details — we take reports seriously and will respond promptly. Please don't share vulnerabilities publicly before we've had a chance to address them.