Security Policy

1. Storage and encryption

Data is stored on a managed PostgreSQL cloud platform. TLS 1.2+, encryption at rest, daily encrypted backups.

2. Access control

Access is enforced at the database level (Row Level Security). Client contact data is not exposed on public pages.

3. Payments

Payments are processed by Paddle (PCI DSS Level 1). DeckEstate does not receive or store card data.

4. Authentication

Email + password or Google sign-in. Passwords are hashed. Leak detection enabled. HTTP-only session tokens.

5. Backups and recovery

Daily automated backups. RTO/RPO — up to 24 hours.

6. Incident response

We will notify affected accounts within 72 hours of confirming an incident.

7. Your rights

Data copy, correction, account deletion — support@deckestate.ge.

8. Contact

Security: security@deckestate.ge.