01
Transport and infrastructure
Public traffic uses HTTPS and modern TLS through the hosting provider. Production secrets are kept in deployment environment controls rather than client code. Database and private-file access are restricted to server-side operations.
02
Authentication and permissions
Accounts use Supabase authentication and verified email. Company roles are enforced on the server. Platform administration is separately restricted to the sole platform-owner identity. Hiding a button is never treated as an access-control mechanism.
03
Tenant and file isolation
Business records are scoped to the authenticated company. Technician identity files and field evidence use private storage and short-lived signed URLs. Public links use cryptographically random, expiring tokens.
04
Payments and webhooks
SharkFlows does not store complete payment-card or bank-account numbers. Stripe-hosted interfaces collect sensitive payment details. Incoming payment and messaging webhooks must pass signature or secret verification before changing records.
05
Operations
Production deployments use versioned database migrations, security tests, error monitoring and audit records. Backups and restoration must be operated and tested as part of the production runbook; this page does not claim an external security certification.
- Rate limiting on sensitive public actions
- Idempotency for payment operations
- Integer minor-unit money calculations
- Incident triage and documented follow-up
06
Report a vulnerability
Please send a concise description, affected URL, reproduction steps and potential impact to admin@sharkflows.com. Do not access another user's data, disrupt service or publish sensitive findings before remediation can be arranged.