SUPVISE LEGAL & TRUST

Security & Data Processing

Security principle: minimize what we receive, never make uploads public, verify payment server-side, and delete data as soon as it is no longer needed.

Security architecture status: v1.3 foundation, 28 August 2026.

Data handling

Inventory spreadsheets are accepted only through HTTPS endpoints. The current architecture processes uploads in application memory and does not intentionally persist the raw spreadsheet after analysis. Generated analysis results are stored outside the public web root using random analysis identifiers and are scheduled for deletion after 7 days.

Upload protections

SUPVISE allow-lists XLSX, XLS and CSV, limits uploads to 20 MB, validates file signatures for Excel formats, randomizes server-side analysis identifiers, does not execute spreadsheet macros, and keeps analysis records outside public static directories.

Access and payment controls

Full results and PDF/Excel exports require a server-side paid entitlement. Browser-side checkout completion alone does not unlock data. Paddle webhooks are verified using HMAC-SHA256 signatures, timestamp checks and idempotent event handling before entitlement is granted.

Infrastructure controls

Production uses HTTPS, security headers, Content Security Policy, least-privilege administration and private application storage. Secrets such as webhook signing keys are environment variables and are not committed to client-side code.

Retention

Raw upload: not intentionally retained after processing. Analysis result: up to 7 days by default. Payment/security event records: retained only as reasonably necessary for fraud, legal, accounting and dispute purposes. Retention will be reviewed as enterprise features are introduced.

Subprocessors

Hostinger: intended hosting/infrastructure provider. Paddle: intended Merchant of Record and payment provider. Production region, subprocessors and transfer mechanisms will be finalized and published before live launch.

Incident response

SUPVISE will maintain a documented process to identify, contain, investigate and remediate security incidents; preserve relevant evidence; assess personal-data impact; and notify customers and authorities where required by applicable law.

Responsible disclosure

A dedicated security contact will be published before launch. Do not test SUPVISE systems in a way that accesses other users' data, disrupts service or violates law.