Core Security Architecture Principles
Genstic enforces strict zero-trust boundaries between public client-side browser execution and server-side transaction handling. Our security model is structured around five immutable rules:
- Absolute Secret Isolation: Server credentials, database passwords, and payment secrets never enter the client-side JavaScript bundle or DOM.
- Timing-Safe Cryptography: All payment reconciliation and webhook verifications use constant-time equality comparisons to prevent timing attacks.
- Strict Least-Privilege Access: Database access is governed by granular Row Level Security (RLS) preventing unauthorized enumeration or cross-tenant data access.
- Zero Payment Card Ingestion: Sensitive payment instruments remain isolated within Razorpay's PCI-DSS Level 1 certified environment.
- Zero Client Tracking: Our application operates without tracking cookies, third-party analytics pixels, or persistent user profiling.
Transport Layer Security (TLS/HTTPS)
All communications between your browser, our edge CDN, and serverless API endpoints are strictly encrypted in transit using TLS 1.3 / HTTPS with modern cipher suites. Unencrypted HTTP requests are automatically upgraded and redirected to secure HTTPS connections.
Payment Instrument Isolation
When you make a payment on Genstic, your card details, UPI credentials, or netbanking accounts are processed inside an encrypted iframe hosted directly by Razorpay Software Private Limited. Genstic servers never receive, process, or store raw card numbers, CVVs, or UPI PINs.
Cryptographic Signature Verification
Every transaction and webhook notification is cryptographically authenticated on the server using HMAC SHA-256 hashing algorithms. Signatures are verified in constant time (`crypto.timingSafeEqual`) to eliminate timing side-channel attacks before orders are marked as paid.
Database Row Level Security (RLS)
Our PostgreSQL database is protected by comprehensive Row Level Security policies:
- Anonymous public requests can only read active services and pricing catalog definitions.
- Direct client-side queries against customer records, orders, payments, invoices, and webhook event tables are strictly denied by database engine policies.
- All transactional record insertions and updates are executed exclusively by trusted server-side DAL connections.
Private Cloud Storage & Invoice Access
Commercial invoice PDFs are stored in private, non-public cloud storage buckets hosted by Supabase. Invoices cannot be publicly enumerated, crawled, or accessed without authorized transaction credentials or short-lived, cryptographically signed download tokens.
Responsible Disclosure & Vulnerability Reporting
We take security seriously and appreciate constructive reports from independent security researchers. If you discover a potential vulnerability or security flaw in our infrastructure, please report it responsibly:
Security Disclosure Contact
Email: privacy@genstic.com
Secondary: hello@genstic.com
Subject: Responsible Security Disclosure
Please include a detailed description of the vulnerability, steps to reproduce, and allow reasonable time for remediation before public disclosure.
Studio Identity
Genstic Studio
Cuttack, Odisha, India PIN 754022
Phone: +91 78559 42305