Security Overview

1. Security approach

Avyukta uses layered application and database controls appropriate to the CRM pilot. This overview describes controls verified in the codebase; it does not claim a security certification or guarantee that every incident can be prevented.

2. Verified controls

• Supabase Auth manages passwords and signed sessions; the CRM application does not store raw passwords.
• Organization membership, active status, role permissions and record scope are revalidated server-side.
• Tenant-aware database row-level security and server authorization checks restrict organization data.
• Uploaded CRM files use private Storage buckets and server-authorized signed downloads.
• Service-role and secret keys remain server-side and are not exposed through NEXT_PUBLIC variables.
• HTTPS, secure production context cookies, SameSite cookie controls and server-side session validation protect browser sessions.
• Revision, status-history and audit records support investigation of important business changes.
• Backups and restore procedures exist, but their approved production retention schedule is documented separately in the Privacy Notice.

3. Client and user responsibilities

• Use strong, unique passwords and do not share accounts.
• Assign the least permissions needed and promptly deactivate access that is no longer required.
• Do not enter prohibited highly sensitive data.
• Review exported files and recipient addresses before sharing documents outside the CRM.
• Report suspected compromise, unauthorized disclosure or unexpected cross-organization access promptly.

4. Report a security concern

Send security reports to hardik@avyukta.ca. Include the affected page or feature, time observed and steps to reproduce, but do not include passwords or unnecessary Client Data.