Stayvora Technologies takes the security of Center and customer data seriously. This policy summarizes the technical and organizational measures we use to protect the platform.
All traffic to and from the platform is transmitted exclusively over HTTPS/TLS — there is no plain-HTTP fallback for any authenticated area. Sensitive credentials stored at rest — such as payment gateway API keys, WhatsApp Business access tokens, and Formax partner credentials (including the AES-based encryption key used for checksum-protected API calls) — are encrypted before storage, never stored or displayed in plain text after initial entry.
Account passwords (Center staff, Super Admin, and customer portal logins) are never stored in plain text or in a reversible format. They are hashed using industry-standard, salted one-way hashing before storage, so that even Stayvora staff cannot view a user's actual password.
Every state-changing request on the platform requires a valid CSRF (Cross-Site Request Forgery) token, preventing a malicious site from tricking a logged-in user's browser into performing an unintended action. All user-supplied input is validated on the server side and output is escaped before rendering, guarding against XSS (Cross-Site Scripting) and injection attacks. Rate limiting and duplicate-request safeguards are applied to sensitive endpoints (login, OTP verification, payment-driven API calls).
The platform enforces role-based access control at every level — Center staff only see their own Center's data, and Super Admin functions are restricted to authorized platform administrators. Every Center's data is scoped and isolated from every other Center's data at the database query level.
Significant account and data actions (logins, record changes, financial transactions) are recorded in activity logs for security review and dispute resolution. The platform is cloud-hosted with regular backups, and security-relevant HTTP response headers are applied to reduce common web attack surface.
Suspected security incidents are investigated promptly. Where a confirmed incident affects Center or customer data, we will notify affected Centers and take corrective action without undue delay, consistent with applicable law.
Centers are responsible for keeping their own staff login credentials confidential and for promptly reporting any suspected unauthorized access to their account. If you are a security researcher who has found a vulnerability, please follow our Responsible Disclosure Policy rather than testing against live Center/customer data.