Security at every layer.
How Starvo protects your business data and your customers' feedback — by design, by architecture, and by default.
1. Account access & authentication
- Supabase Auth. Email/password (hashed) or Google OAuth. No Starvo-side password database outside Auth.
- Server-enforced ownership. Every API route verifies that the authenticated user owns or is authorised for the record. UI gating is defence in depth, not the gate.
- Role-based permissions. Owner, Manager, and Staff are checked server-side on every action.
- Admin panel is locked to an allowlist, with same-origin CSRF checks and per-admin rate limits.
- Cron routes are gated by a separate
CRON_SECRETusing timing-safe comparison.
2. Database security
- Row-level security (RLS) on every table — enforced inside Postgres, not only in application code.
- Managed Postgres via Supabase. Encryption at rest, backups, point-in-time recovery, HTTPS-only connections. Supabase publishes SOC 2 Type II for its platform (provider certification — not a Starvo SOC 2 attestation).
- Google OAuth tokens are column-locked: staff/manager SELECT on
access_token/refresh_tokenis revoked. - Race-prone writes (location creation, reply quota) use Postgres advisory locks via RPCs.
- Soft deletes with a 48-hour recovery window. Hard delete is a scheduled job.
3. Payment security
- Dodo Payments is the Merchant of Record. Starvo never receives, stores, or transmits card numbers, CVVs, or bank details.
- Webhooks are signature-verified (Standard Webhooks) before any plan change is applied.
- Idempotent event handling — every webhook event is deduplicated by event ID so retries are safe.
4. Transport & infrastructure
- HTTPS only. HSTS preload, long max-age, includeSubDomains.
- Strict Content Security Policy,
X-Frame-Options DENY, and Permissions-Policy blocking camera, microphone, geolocation, and FLoC. - Hosted on Vercel with Supabase for data. Secrets live in environment variables — never in client bundles.
5. AI & review content
- AI drafts are opt-in. Review text is sent to Groq only when you click Generate (or when analysis runs for a submitted review).
- No auto-publish. Humans always edit and send. No solely automated decisions with legal effect.
- We do not train models on your review content. See the Privacy Policy.
6. Cookies & tracking
Strictly necessary auth cookies only. No Google Analytics, Meta Pixel, or advertising trackers. Details: Cookie Policy.
7. Reporting a vulnerability
Disclose responsibly to security@starvo.app. We aim to acknowledge within 2 business days and triage within 5 business days. No paid bug-bounty programme today; we credit reporters on request once fixed.
Give us a reasonable window before public disclosure. Do not access or modify any account that is not your own when testing. Unauthorised probing is prohibited under the Acceptable Use Policy.
FAQ
Who owns the review data?
You do. Private feedback collected through your QR code belongs to your business. You can export it any time as CSV from your dashboard. Starvo does not sell your data and does not share it with third parties beyond what is required to run the service (e.g., Supabase, Groq, Resend).
Is Starvo GDPR-compliant?
Yes. We store the minimum data needed to run the service. Customers submitting reviews can do so anonymously — email is optional. On account deletion, your data enters a 48-hour soft-delete window then is hard-deleted by a scheduled job.
How do I delete my account?
From Settings → Danger zone, request deletion. Your account enters a 48-hour grace period during which you can cancel the deletion. After 48 hours, your business, reviews, and any private data are permanently removed.
How secure is Starvo?
All API routes verify ownership server-side, all admin and cron routes are secret-gated, and all webhook events are signature-verified and deduplicated. Database access uses row-level security. Card details are handled by Dodo Payments (a Merchant of Record) — Starvo never sees them.
Where is my data stored?
Your data lives in a managed Postgres database via Supabase, with row-level security enforced on every table. Background services (email, AI, payments) only see the minimum payload needed for the task.