Security
How Carcasso protects your work
What is in place today, in plain words. If you find a problem, email [email protected] and we will reply within 1 business day.
Your data
- Accounts, designs and share links are stored in Supabase in Sydney, Australia, with row-level security so each account can only read its own rows.
- Every connection is HTTPS; the site sends Strict-Transport-Security so browsers never fall back to plain HTTP.
- You can download everything you have (Settings → Download my data) and delete your account (Settings → Delete my account) yourself.
- A share link is a long random token; it shows only that one design, and it can be turned off from the app.
Payments
- Cards are entered on Stripe's own checkout page. Carcasso never sees or stores card numbers.
- Subscription changes come from Stripe's signed webhook; the customer portal handles cancellations.
Accounts
- Email sign-ups prove the inbox with an emailed code; disposable email domains are refused; passwords are at least 8 characters. Google sign-in is also available.
- Sign-out revokes the session on the server, not just in the browser.
- API calls are rate-limited per address and per account.
Backups and recovery
- A full archive of the database is taken daily and checked by the health monitor; the restore procedure has been drilled end to end.
- Any outage or failing check alerts the team immediately.
Reporting a problem
- Use Report a problem inside the app (it reaches the team within minutes) or email [email protected]. Please do not post security issues publicly; we will acknowledge within 1 business day.