Security at every layer.
Starvo handles the reputation of your business. Here's exactly what we do to keep your data — and your customers' data — safe.
Access control
- Server-enforced ownership. Every API route verifies that the authenticated user owns the record. UI gating is defense in depth, not the gate.
- Role-based permissions. Owner, Manager, and Staff roles are checked server-side on every action.
- The admin panel is locked to an allowlist. Founder-only access — restricted to specific admin accounts, with a same-origin (CSRF) check and a per-admin rate limit on every action.
- Cron routes are gated by a separate
CRON_SECRETusing timing-safe comparison.
Database
- Row-level security (RLS) on every table — no service can read or write a row that doesn't belong to its caller.
- Managed Postgres via Supabase. Backups, point-in-time recovery, and HTTPS-only connections.
- Race-prone writes (location creation, quota claims) use Postgres advisory locks via RPCs to avoid double-spend.
- Soft deletes with a 48-hour recovery window. Hard delete is a scheduled job, not an instant action.
Payments
- Dodo Payments is the Merchant of Record. Starvo never stores or sees card details.
- Webhooks are signature-verified using the Standard Webhooks signing protocol.
- Idempotent event handling. Every webhook event is deduplicated by event ID so retries are safe.
Transport and headers
- HTTPS only. HSTS preload, 2-year max-age, includeSubDomains.
- Strict Content Security Policy — no inline scripts beyond fonts and Google OAuth flows.
- X-Frame-Options DENY on app pages,
frame-ancestors 'self'in CSP. - Permissions-Policy blocks camera, microphone, geolocation, and FLoC.
Reporting a vulnerability
If you have found a security vulnerability in Starvo, please disclose it responsibly by email to security@starvo.app. We aim to acknowledge reports within 2 business days and to triage and respond within 5 business days. We do not currently run a paid bug-bounty programme, but we are grateful for responsible disclosures and will credit reporters on request once an issue is fixed.
Please give us a reasonable window to remediate before any public disclosure, and please do not access or modify any account that is not your own when testing.
FAQ
Who owns the review data?
You do. Private feedback collected through your QR code belongs to your business. You can export it any time as CSV from your dashboard. Starvo does not sell your data and does not share it with third parties beyond what is required to run the service (e.g., Supabase, Groq, Resend).
Is Starvo GDPR-compliant?
Yes. We store the minimum data needed to run the service. Customers submitting reviews can do so anonymously — email is optional. On account deletion, your data enters a 48-hour soft-delete window then is hard-deleted by a scheduled job.
How do I delete my account?
From Settings → Danger zone, request deletion. Your account enters a 48-hour grace period during which you can cancel the deletion. After 48 hours, your business, reviews, and any private data are permanently removed.
How secure is Starvo?
All API routes verify ownership server-side, all admin and cron routes are secret-gated, and all webhook events are signature-verified and deduplicated. Database access uses row-level security. Card details are handled by Dodo Payments (a Merchant of Record) — Starvo never sees them.
Where is my data stored?
Your data lives in a managed Postgres database via Supabase, with row-level security enforced on every table. Background services (email, AI, payments) only see the minimum payload needed for the task.