Aapka paisa aapka hai.
Aapka data bhi.
Trove early testing mein hai aur ek insaan ise banata hai. Yahan seedha hisaab hai ki aaj aapke data ko kya bachata hai, aur utna hi zaroori, ki kya abhi nahi hai. Is page pe kuch bhi future ka promise nahi hai.
Encryption
Har jagah HTTPS, HSTS preload ke saath. Rakha hua data Supabase ke managed Postgres mein, aur upload ki gayi receipts Supabase Storage mein encrypt hoti hain.
Hum aapke bank ko chhoote tak nahi
Trove ka koi bank connection nahi hai. Koi Plaid integration nahi, koi credentials nahi, koi tokens nahi. App mein sab kuch wahi data hai jo aapne khud likha ya import kiya.
Login
Email aur password ya Google OAuth, dono Supabase Auth sambhalta hai. Passwords Supabase hash karta hai aur woh kabhi Trove tak nahi pahunchte. Two-factor authentication abhi available nahi hai.
Data isolation
Har table pe Postgres row-level security, taaki koi query sirf aapki apni rows laa sake. Receipts aapke user id tak limited ek private bucket mein rehti hain aur short-lived signed URLs se milti hain.
Monitoring
Server logs aur har write ka in-app audit trail. Ek /api/health endpoint batata hai database reachable hai ya nahi. Errors Sentry ko bheje jaate hain, emails, lambe numbers aur identifiers hata ke. Is website pe Google Analytics sirf aapke accept karne ke baad chalta hai, aur Cloudflare bina cookies ke page views ginta hai. Abhi koi formal uptime monitoring ya on-call rotation nahi hai.
Compliance
Trove ka SOC 2 audit nahi hua hai aur abhi koi audit chal nahi raha. Aap Settings se kabhi bhi apna saara data export kar sakte ho aur account hamesha ke liye delete kar sakte ho.
Kya abhi nahi hai
Kamiyon ke baare mein saaf rehna testing phase ka hissa hai:
- Two-factor authentication nahi.
- Kisi bahar ki company ka security audit ya penetration test nahi.
- Uptime ya incident response ka koi formal commitment nahi. Raat 2 baje kuch toote, toh mere jaagne tak toota rahega.
- Koi bug-bounty programme nahi.
Trove ko kisi bhi early product ki tarah lo: apna kharcha saaf dekhne ke liye kaam ka, official record nahi.
Responsible disclosure
Agar aapko koi vulnerability mile, toh email karo [email protected]. Main khud padhta hoon aur jitni jaldi ho sake reply karunga. Main aisa response time nahi bataunga jiski guarantee na de sakoon. Public karne se pehle mujhe fix karne ka mauka do. Koi bounty nahi hai, par aap chaho toh release mein aapka naam dunga.