Security

1. Our Commitment

Security is not an add-on feature at SuperCart; it is the core foundation of our cashierless retail technology. We implement advanced defensive engineering practices to protect merchant stores, customer identities, and financial transactions from leakage, unauthorized access, and database tampering.

2. Data Encryption

Encryption in Transit: All communications between store client devices, guard verification apps, merchant dashboards, and our API backends are encrypted using TLS 1.3 protocol.
Encryption at Rest: Sensitive storage fields, including store system keys and transaction references, are encrypted at rest using AES-256-CBC encryption blocks.
Password Hashing: Credentials and guard logins are protected using bcrypt algorithms with a custom work factor (10 rounds).
Customer Identity: Customer mobile number authentication is processed securely via Firebase Authentication protocols, eliminating password vulnerability.

3. Infrastructure Security

Cloud Environment: SuperCart servers are hosted inside Google Cloud Platform container instances located in the asia-south1 (Mumbai, India) region to ensure low latency and strict local data compliance.
Network Isolation: Google Cloud SQL database clusters operate exclusively within private VPC boundaries. No direct SQL or database ports are exposed to the public internet.
Compute Routing: Backend services run inside Google Cloud Run instances shielded by Cloud Armor firewalls to automatically mitigate DDoS attacks.

4. Payment Security

All client payments are processed directly by Razorpay, a PCI-DSS Level 1 compliant gateway. SuperCart servers never receive, process, or store raw credit card numbers, CVVs, or NetBanking pins. Individual merchant integration credentials are encrypted independently using envelope encryption before storage. Double-spend and checkout validation events require secure cryptographic webhook signatures to prevent cart tampering.

5. Access Control

Dashboard access is authenticated using JSON Web Tokens (JWT) featuring strict 7-day expiry boundaries. We enforce Role-Based Access Control (RBAC) separating permissions into four tiers: Store Owner, Guard, Administrator, and Shopper. Database structures utilize logical separation, guaranteeing that one store's staff or scanners cannot view, query, or affect the inventory catalog of another store brand.

6. Responsible Disclosure

If you are a security researcher and identify a vulnerability in the SuperCart B2B software, customer apps, or websites, please notify our security team at support@getsupercart.in with the subject line "Security Disclosure". We commit to:

Responding to your disclosure within 48 hours.
Working collaboratively with you to resolve the issue as quickly as possible.
Refraining from pursuing legal action against good-faith security researchers who abide by standard ethical disclosure terms.

7. Compliance

Our software stack, hosting clusters, and merchant data operations adhere to standard security acts, including: