Security Practices

All payments are processed by Stripe, a PCI-DSS Level 1 certified payment provider. Card numbers, CVC codes and bank details are entered directly into Stripe-hosted or Stripe-embedded fields. Sapienbase never receives, processes or stores full card numbers or CVC codes. We retain only the non-sensitive references Stripe returns to us (order id, last four digits, card brand, country, outcome).

• TLS encryption for all traffic in transit; HTTPS enforced site-wide.
• Encryption at rest for the application database.
• Passwords stored only as salted hashes; we cannot read your password.
• Row-level access control on user data, so a signed-in account can only read its own records.
• Least-privilege secret management; privileged keys are server-side only and never shipped to the browser.
• Signed and verified webhooks for payment and email events.
• Application and administrative activity logging, with alerting on payment-processing failures.
• Automated dependency review for known vulnerabilities.

• Use a unique, strong password and do not reuse it elsewhere.
• Do not share your login — accounts are personal and single-user.
• Sign out on shared devices and keep your email account secure, since it can reset your password.
• We will never ask you for your password, a full card number, or a one-time code by email or chat.

Report suspected vulnerabilities to security@sapienbase.com with steps to reproduce, affected URLs and any proof-of-concept. We aim to acknowledge within 3 business days and to keep you informed while we investigate.

Please act in good faith: test only against your own account, do not access, modify or exfiltrate other users' data, do not run denial-of-service, spam, social-engineering or physical attacks, do not use automated scanners that degrade the Service, and give us a reasonable period to remediate before any public disclosure. We will not pursue legal action against researchers who follow these rules. We do not currently operate a paid bug-bounty programme, but we credit reporters on request.

If a personal-data breach is likely to result in a risk to your rights, we notify affected users and, where required, the competent supervisory authority within 72 hours of becoming aware of it. See the breach-notification section of our Privacy Policy.

No platform can be guaranteed secure. Nothing on this page is a warranty, guarantee or representation that the Service is free of vulnerabilities, and it does not create any contractual obligation beyond our Terms of Service. We do not claim any third-party security certification for Sapienbase itself.