Security

1. Data in transit

All traffic to and from Coldrply is served over HTTPS/TLS. We do not accept requests over plain HTTP.

2. Accounts & access control

• Authentication is handled by Supabase Auth. Sessions are verified against the auth server on every privileged request, not merely decoded from a cookie.
• Our database enforces Row Level Security, so a signed-in user can only read and write their own rows.
• Administrative access is restricted to an explicit email allowlist held in server-side configuration — it cannot be granted from the client.

3. Payments

Payments are processed by Razorpay, a PCI-DSS compliant payment gateway. Card details are entered directly into Razorpay’s checkout and are never seen, transmitted or stored by Coldrply. We retain only payment metadata — plan, status and transaction identifiers.

Payment notifications from Razorpay are authenticated with an HMAC-SHA256 signature and rejected if the signature does not verify, so credits cannot be granted by a forged request.

4. Gmail connection

Connecting Gmail for reply tracking is optional. When connected, we access read-only message metadata (subject, sender, timestamp) in order to detect replies. We never read your email bodies, and we never send mail on your behalf. You can revoke the connection at any time from Account Settings, which deletes the access grant.

5. Infrastructure & monitoring

Coldrply runs on managed infrastructure (Vercel and Supabase). Application errors are monitored with Sentry so that faults are detected and fixed quickly. Secrets and privileged keys are held server-side only and are never exposed to the browser.

6. Reporting a vulnerability

If you believe you have found a security issue, please tell us before disclosing it publicly. Email riddhesh@coldrply.com with “Security” in the subject line and enough detail to reproduce the issue.

We will acknowledge your report, keep you updated while we investigate, and credit you once a fix has shipped if you would like us to.

7. Honest limits

Coldrply is an independent product and we do not currently hold a formal certification such as SOC 2 or ISO 27001. No system is perfectly secure. We apply the practices described above, rely on established providers for the hardest parts (auth, payments, hosting), and fix issues promptly when they are found.