Security Policy

Reporting a vulnerability

We take security seriously. If you find a vulnerability in CartGain, please report it privately to security@cart-gain.com. Please include: the affected endpoint, steps to reproduce, and impact. We commit to a prompt response (within 72 hours) and will never take legal action against good-faith researchers.

Our safeguards

• All traffic encrypted in transit (TLS) — HTTPS only, terminated at the hosting edge (Vercel).
• Customer data encrypted at rest (Supabase managed Postgres; secrets AES-256-GCM).
• Row-level security (RLS) enabled on database tables where configured (per the migration history — not all tables), with access additionally controlled by server-side authorization in the application.
• Strict access logging with PII redaction for every protected-data access.
• Automatic data retention — cart PII anonymized after 90 days; bargain sessions deleted after 90 days; access logs deleted after 180 days; stale verification tokens deleted after 7 days.
• Rate limiting on authentication and public endpoints.
• Secrets stored only in environment variables; never in the repository.

Protected customer data

We process only the minimum personal data needed for the app to function: the contact details and line-item information of customers who abandon a checkout, and the optional email/phone a shopper provides to start a price negotiation. All of it is used solely to recover carts and run negotiations — never sold, never shared for advertising, and never used to contact a customer who has opted out.

We honor every customer consent and opt-out decision: a “Skip AI, buy at full price” option ends a negotiation immediately, and merchants can suppress individual customers or reply-to-STOP for messaging channels. Opt-out records are kept indefinitely as consent records, while message and cart data are automatically anonymized or deleted on the retention schedule in our Privacy Policy.

Backups and environments

• Backups: Managed database backups at Supabase are encrypted and retained for a short, defined window so any copy of personal data is subject to the same protection as production data.
• Environment separation: Test and production are strictly separate — production credentials are never available in test/development environments, and production data is never copied into development. Development builds use fixture data only.

Data loss prevention

• Protected customer data is read programmatically only through audited, purpose-scoped service paths — never through ad-hoc queries.
• Every access is logged with PII redaction (see “Access logging” below), creating a deterrent against and an audit trail for any exfiltration attempt.
• Database credentials are held only in production environment variables, never in the repository or client code.

Staff access and passwords

• Least privilege: CartGain team members are granted access to customer data only when their role requires it, and only through the audited service paths above.
• Strong passwords: All staff accounts require passwords of at least 12 characters mixing letters, numbers, and symbols, in addition to multi-factor authentication.
• Privileges are reviewed and revoked when an individual no longer needs them.

Access logging

Every read or write of protected customer data writes an immutable audit entry recording the actor, action, resource, purpose, and timestamp. Sensitive values are redacted before the entry is stored — emails are masked, phones truncated to the last four digits — so the log provides a full audit trail without duplicating the data itself. Logs are retained for 180 days and reviewed regularly by the team to confirm the controls are working as intended.

Incident response

We maintain an internal incident-response policy (IRP) with a severity scale (P1–P4), defined roles, escalation paths, and evidence-collection steps. In the event of a security incident or data breach we will:

• Contain and remediate the cause immediately, preserving evidence as we do so.
• Rotate all potentially exposed secrets.
• Notify affected merchants within 72 hours of confirmed impact.
• Notify regulators where legally required (e.g., GDPR / DPDP Act 2023).
• Document the incident, root cause, and corrective actions internally.

Sub-processors

• Vercel — application hosting & CDN
• Supabase (PostgreSQL) — database hosting
• Upstash (Redis) — job queue & caching
• OpenAI — AI negotiation model (GPT-4o / GPT-4o-mini)
• Groq — AI development/fallback inference (gpt-oss-120b)
• Resend — transactional email (not yet runtime-configured)
• Meta (WhatsApp Cloud API) — WhatsApp delivery (not yet runtime-configured)
• Razorpay — subscription billing (not yet runtime-configured)

Data processed by each provider is purpose-limited and minimized (for example, only the negotiation transcript is sent to the AI provider). Sub-processor agreements are being executed as listed in CartGain's sub-processor disclosure. See the Data Processing Agreement for details.