Security & Data

• Encrypted cloud database hosted on Supabase in the Mumbai region (ap-south-1), inside India.
• PDFs stored in private storage, served via short-lived signed links.
• PDFs generated on our servers — not in your browser.

• Every record is scoped to your business.
• Row-level access control on every table.
• Admin credentials never reach the browser.

• Money is stored as integer minor units (e.g. paise). Never floats.
• Finalized invoices are immutable snapshots; we store the generated PDF.
• Idempotent payment and invoice creation to prevent double-submit.

• Email + password sign-in with secure session cookies.
• HttpOnly, secure cookies for the web app.

• TLS in transit.
• Encryption at rest from the cloud provider.

Mavoin runs on Supabase's managed Postgres, which is backed up by Supabase as part of the managed service. We are not publishing a backup frequency, retention window or point-in-time-recovery claim until we can state exactly what our plan provides — a recovery promise we can't hold would be worse than no promise at all. In the meantime, nothing stops you keeping your own copy: every finalised invoice is a PDF you can download and archive.

Every third party that processes data on our behalf is named on the trust page, along with what each one does and where it runs.

Email hello@mavoin.com with a short description. We respond within 24 hours. Every other way to reach us — and what to include — is on the contact page.