How your data is protected

Every connection to OneProof — the dashboard, your public collection form, embedded widgets, your Wall of Love page and the API — is served over HTTPS/TLS through Cloudflare's edge network. Plain HTTP requests are upgraded, not accepted.

This applies equally to traffic between your customers and your form, and between your browser and the dashboard.

Account data, workspace settings and testimonial content (text, transcripts and metadata) are stored in a managed Postgres database (Supabase), which encrypts data at rest at the storage layer.

Uploaded media (video and audio testimonials) is held in encrypted object storage, served only via short-lived signed URLs generated on demand — never through a permanent public path.

OneProof uses the same account system as the rest of the OneOS suite, so signing in once carries your identity across every OneOS product.

Passwords are never stored in plain text. Email/password accounts are hashed with a salted, industry-standard algorithm before storage — OneProof never sees or logs your raw password.

You can also sign in with Google; in that case, credential management stays with Google and there's no OneProof password to store at all.

Every table is scoped by row-level security policies keyed to your workspace and project, so one customer's data is never reachable from another's session — even if a query were written incorrectly.

Inside a workspace, Teams (Pro) lets you assign granular roles — Owner, Admin, Editor or Viewer — so you control who can moderate testimonials, edit forms or manage billing.

Signed media URLs expire after a short window, and administrative operations (like reading integration tokens) go through service-role code paths that are never exposed to the browser.

OneProof runs on Cloudflare's global edge network, which fronts every request with DDoS protection and a CDN, and hosts the application itself on Cloudflare Workers.

The database, authentication and file storage layers run on managed Postgres via Supabase — a provider that handles patching, backups and infrastructure hardening so your data isn't sitting on a self-managed, unpatched box.

OneProof's billing runs on the live payment infrastructure shared across OneOS: Stripe for international cards and Razorpay for Indian payment methods, both PCI-DSS compliant processors.

Card and bank details are entered directly into Stripe's or Razorpay's own secure checkout — they never pass through or get stored on OneProof's servers.

Supabase — database, authentication and file storage.

Cloudflare — hosting, CDN and DDoS protection.

Stripe and Razorpay — payment processing.

Resend and Amazon SES — transactional and invite email delivery (only used if your workspace has one configured).

OpenRouter — optional AI provider behind AI Features (transcription, sentiment, case-study generation); only invoked for workspaces on a plan with AI enabled.

If we become aware of a security incident that affects your account or customer data, we'll notify affected workspace owners without undue delay, along with what happened, what data was involved, and what we're doing about it.

If you believe you've found a security issue in OneProof, please report it responsibly rather than exploiting it or sharing it publicly.

Email support@pixelperfect.co.in with a clear description, steps to reproduce, and any relevant request/response details. We'll acknowledge your report and follow up as we investigate and fix it.