Your clients trust you. You can trust us with their data.

Encryption

• All data travels over HTTPS
• The database is encrypted at rest by Supabase (AES-256)
• API keys and secrets are kept in encrypted environment variables, never in the code
• Passwords are hashed with bcrypt by Supabase Auth; we never see them

Infrastructure

• The planning server runs on Render (SOC 2 Type II)
• The database runs on Supabase, on AWS in the Singapore region (SOC 2 Type II)
• The website is served by Vercel, with certificates managed automatically

Access controls

• Row-level security on every database table, so each practitioner sees only their own clients
• Signed tokens (JWT) from Supabase Auth on every request
• Your plan is checked on the server for every request, never trusted from the browser
• Rate limits on the API to prevent abuse
• Payment events verified with HMAC-SHA256 signatures

DPDP practices (India)

• Personal data is processed only for nutrition planning and running your account
• Right to erasure: write to us to delete your account and all its data
• No personal health data is sold or shared for advertising
• Data minimisation: we collect only what plan generation needs
• Plans are calculated on our own servers; the optional AI drafting features send text to Google only when you use them

Application security

• Error monitoring with Sentry, with health data and identities removed
• Every API input validated with typed models
• Cross-origin requests restricted to our own sites
• No sensitive data in URLs or query strings
• Regular dependency updates and security reviews

Payment security

• Payments processed by Razorpay (PCI DSS Level 1)
• We never store card numbers or CVVs
• Each payment is verified on the server before your plan changes
• A payment is applied once, even if it is reported twice

Questions about security?

We’re happy to explain how we protect your data, and we welcome reports of anything that looks wrong. Write to prosupport@ulakmicros.com.