Security Policy
Last updated 2026-06-25 · How we protect the platform.
Architecture
Encryption in transit (TLS 1.2+), encryption at rest, Row-Level Security on user-owned data, signed URLs for media, audit logs on sensitive actions.
Operations
Least-privilege admin access, MFA for staff, secret rotation, automated backups, dependency scanning.
Vulnerability reporting
Report security issues to security@bachao.app. We follow responsible disclosure and credit reporters.
This document is maintained by Bachao and reviewed periodically. Sections related to regulated activities require qualified legal review prior to launch in your jurisdiction.