Skip to content
Log inStart free trialGet demo
Trust

Security

Last updated

Installers trust SunSolarOne with their pipeline and their customers' details. This page summarises how we protect that data. For how we use personal data, see our Privacy Policy and Data Processing terms.

Hosting in India

  • The database, file storage and authentication run on Supabase in the AWS Mumbai region (ap-south-1), so your data is stored in India.
  • The website and application run on Vercel, with server functions in the Mumbai region next to the database.
  • Both providers operate audited infrastructure (SOC 2 Type II) on AWS data centres.

Encryption

  • All traffic uses HTTPS (TLS 1.2 or later), with HSTS so browsers never fall back to plain HTTP.
  • Data at rest — the database, backups and stored files — is encrypted with AES-256 by our hosting providers.
  • Secrets you give us, such as your Razorpay API keys, are additionally encrypted in the application with AES-256-GCM before they are stored.

Tenant isolation

  • Every record belongs to one company. Postgres row-level security (RLS) policies enforce, inside the database itself, that users can only read and write their own company's data.
  • Automated checks run every database change against an in-memory copy of the schema and confirm one company can never read or write another's data.
  • Files (site photos, bills, proposal PDFs) are kept in private storage buckets under each company's folder, and are shared only through short-lived signed links.
  • Public proposal links use long random tokens, and views are logged with a hashed IP address rather than the IP itself.

Access and sign-in

  • Passwords are never stored in plain text; sign-in is handled by Supabase Auth with hashed passwords, email confirmation and phone OTP for field staff.
  • Roles inside each workspace control who can see and change what; owners can remove a user at any time.
  • Customers use one-time passwords to sign proposals and to open the customer portal, with short, signed sessions.
  • Access to production systems within SunSolarOne is limited to the people who need it.

Application security

  • Security headers on every response, including a Content Security Policy, frame protection and strict referrer rules.
  • Rate limits on sign-in, OTP, sign-up, contact forms, public links and exports to slow down abuse.
  • Inputs are validated on the server, and database access goes through parameterised queries and RLS.
  • Changes are type-checked, linted and tested before release.

Backups and recovery

  • The database has daily backups and point-in-time recovery, so it can be restored to any moment in the retention window.
  • We also keep periodic off-site copies so a restore does not depend on a single provider.
  • You can export your own data at any time from Settings → Export, as JSON or CSV.

Payments

Card, UPI and net-banking details are entered on Razorpay's PCI DSS-compliant checkout and never reach our servers. Payment confirmations from Razorpay are verified with a signature before we record them.

Incidents

If a security incident affects your data, we will tell you without undue delay — within 48 hours of confirming it for customer personal data — explain what happened and what we are doing, and help you meet your own obligations. We report incidents to CERT-In and the Data Protection Board of India where the law requires.

Reporting a vulnerability

If you think you have found a security issue, please email support@sunsolarone.com with the details and steps to reproduce. Please do not access other people's data, disrupt the service or publish the issue before we have fixed it. We will acknowledge your report within 2 working days and keep you updated.