Security Policy

All traffic is served over TLS 1.2+. HSTS is enabled. Internal service-to-service traffic is authenticated and scoped to the minimum required roles.

• Passwords stored as salted hashes; never accessible in plaintext.
• Payment-gateway credentials and sensitive tokens are encrypted with AES-256-GCM.
• Managed cloud storage encrypts data at rest.

• Row-Level Security policies enforce society and role scoping on every table.
• Roles are stored in a dedicated permissions table, not on user profiles, to prevent privilege escalation.
• Service-role keys are used only in server functions and edge webhooks, never in the browser.
• Administrative actions are audited.

Email & password with strong password rules, optional passkeys (WebAuthn), device-based "remember this device" and session revocation from Account Security.

Contact forms, sign-ins and other sensitive endpoints are rate-limited. Anti-fraud checks are applied to referrals and campaign events.

Continuous database backups with point-in-time recovery. Restore procedures are tested regularly.

We run automated dependency scanning, database linters and periodic manual reviews. Findings are tracked to closure.

Documented playbook: detect, contain, investigate, notify affected users where required by law, remediate, and publish a post-incident review for major events.

Report vulnerabilities to security@rentwithoutbroker.in. Do not access other users' data. We acknowledge within 3 working days and credit reporters where appropriate.