Data Security

This document presents, for information, the security principles applied to the PayPulss service. It complements the privacy policy and the terms of use.

1. Authentication and access

• Account access relies on an authentication mechanism managed by our technical provider (Supabase Auth): passwords stored in a secure form (hashing), sessions consistent with common practice.
• We do not ask you to transmit server secrets (“service” keys or equivalent) in the web interface: when such elements exist, they must remain confined to controlled server environments.

2. Data isolation (multi-user)

Records linked to your activity (clients, invoices, reminder settings, etc.) are stored in a database with Row Level Security (RLS) policies intended to limit read and write access to rows associated with your authenticated account. The effective configuration must be maintained and audited as the product evolves.

3. Transport and hosting

• Exchanges with the application generally use HTTPS (encryption in transit).
• Data at rest is hosted with the selected providers (notably Supabase and the front-end host) according to their security commitments. We do not claim certifications we do not explicitly hold.

4. Backups and integrity

Backup and restore policy depends on options subscribed with providers and project configuration. Internally document backup frequency and restore procedures.

5. Vulnerability reporting

If you believe you have identified a security flaw, please contact us responsibly at contact@paypulss.com (message subject: security report), avoiding public disclosure of exploitable details before a reasonable fix.

6. Roles and responsibilities

Service security is shared: the publisher implements reasonable measures on the infrastructure and application side; the user must protect credentials, use strong passwords, and follow good practices on their workstations.