Security Policy
Last updated: June 2026
1. Security Commitment
At Stivate, we understand that client and business operational data is highly sensitive. We are committed to maintaining the confidentiality, integrity, and availability of all data processed within our CRM and customer systems. This Security Policy outlines the practices we follow to protect our systems and your data.
2. Infrastructure & Data Hosting
Our infrastructure is designed for high-availability, scalability, and security:
- Hosting: Our web servers are hosted on Vercel's global edge network, providing secure, DDoS-resistant, and high-performance serverless endpoints.
- Database: Operations data is hosted on Neon serverless PostgreSQL, executing within secure AWS clouds with automatic scaling and replication.
- Encryption in Transit: All web connections are encrypted using modern SSL/TLS (HTTPS) protocols, enforcing secure cryptographic suites.
- Backups: Database snapshots are captured automatically every 24 hours and retained securely for recovery in case of hardware failures.
3. Authentication & Access Control
We restrict systems access strictly based on the principle of least privilege:
- NextAuth Verification: Internal admin views are guarded by NextAuth v5 session checks linked to Google Workspace OAuth. Only whitelisted workspace emails are permitted to create a session.
- Role-Based Access Control (RBAC): Access to business tools (clients, invoices, pricing estimations) is regulated by roles:
ADMIN,MANAGER, andSTAFF. - Session Expiry: Session JSON Web Tokens (JWT) are signed cryptographically and automatically expire after a set period of inactivity, requiring re-authentication.
4. Software & Application Security
We build our codebases using secure coding standards to mitigate threat vectors:
- Prisma ORM Protection: Database queries use Prisma ORM parameterized queries to eliminate SQL Injection (SQLi) vulnerabilities.
- Input Validation: Server Actions and API endpoints validate payload formats before execution.
- Dependency Management: Node.js package dependencies are periodically audited for common CVE vulnerabilities.
5. Vulnerability Reporting
If you discover a security vulnerability in our systems, please report it immediately to hello@stivate.com. We take all vulnerability disclosures seriously and aim to acknowledge reports within 24 hours.