Last updated: 21 September 2026

Security

Template — this describes our current technical approach for transparency. Review with your security team before publishing, and keep it in sync with the product as it evolves.

We take the security of your company's data seriously. This page summarises how Perfoin is built and operated to protect it.

1. Hosting & infrastructure

The platform runs on Vercel (application hosting) with data stored in a managed Supabase PostgreSQL database hosted in Mumbai, India (ap-south-1). PostgreSQL is the single source of truth; the browser only ever holds a cache. Our providers maintain their own physical, network and platform security controls.

2. Encryption

All traffic between your browser and the platform is encrypted in transit using TLS (HTTPS). Data at rest is encrypted by our managed database and hosting providers.

3. Authentication & sessions

Authentication is handled by Auth.js with signed JWT sessions.
Passwords are never stored in plain text — they are hashed with bcrypt.
Sessions have configurable lifetimes; administrators can revoke sessions, and repeated failed sign-ins trigger safe lockout recovery.

4. Access control & tenant isolation

Multi-tenant isolation — every record is scoped to its company; one tenant's data is never exposed to another.
Role- and level-based access — a configurable permission engine derives each user's data scope, and page/tab/field/action visibility is enforced server-side; hidden pages are also route-protected.
Least privilege — non-admin users never see admin or configuration surfaces.

5. Auditing & logging

Create, edit, delete, approve, publish, export and access/security changes are written to an immutable audit history that records who did what, when, and (where permitted) from where — supporting investigation and accountability.

6. Availability & backups

Database durability and backups are managed by our database provider. We monitor the service and apply security updates to our dependencies.

7. Data privacy

How we collect and use personal data is described in our Privacy Policy. Optional third-party integrations (e.g. Google Calendar/Meet) are only connected when a user chooses to.

8. Your responsibilities

Security is shared. Please use strong, unique passwords, manage user access promptly (especially when people leave), and report anything suspicious.

9. Responsible disclosure

If you believe you have found a security vulnerability, please email security@perfoin.app (placeholder — replace with your real address) with details. Please give us a reasonable time to investigate and fix before any public disclosure. We appreciate responsible reports.

10. Contact

For security questions, email security@perfoin.app or use the contact form. See also our Privacy Policy and Terms of Service.