1. Credentials
Passwords are hashed with scrypt using a unique per-user salt and are never logged, emailed or displayed. Password and session comparisons run in constant time to resist timing attacks. We cannot recover your password — only reset it.
2. Sessions
Sign-in issues an HMAC-SHA256 signed token that expires after 24 hours and carries no sensitive data. Signing out revokes every token issued to your account immediately, so a token that leaks cannot outlive your session.
3. Administrative Access
The admin console requires a separate credential, an expiring server-side session, and supports time-based one-time-password (TOTP) two-factor authentication. Administrative endpoints reject unauthenticated and forged tokens.
4. Payments
Card numbers, UPI PINs and net-banking credentials are entered on Razorpay’s PCI-DSS compliant infrastructure and never touch Saudaa servers. We retain only the transaction reference and plan purchased.
5. Transport and Application Hardening
All traffic is served over HTTPS with HSTS preload. We set a strict Content-Security-Policy, X-Content-Type-Options, X-Frame-Options and Referrer-Policy, validate and sanitise all input server-side, and rate-limit authentication with progressive lockout on repeated failures.
6. Data Storage
Application data is held in a managed Postgres database with row-level security enabled. Uploaded chart images are validated by content signature, stored in the database rather than the web root, and are never executed.
7. Your Responsibilities
Use a unique password, enable two-factor authentication where offered, never share your Subscriber ID or credentials, and sign out on shared devices. Tell us immediately if you suspect unauthorised access.
8. Reporting a Vulnerability
Please follow the Responsible Disclosure Policy.