Security and data protection

Every table carrying studio data is protected by row-level security in Postgres. Access is scoped to your account by the database itself, not by a filter in application code that a future bug could omit. A query that forgets to restrict itself returns nothing rather than someone else's rows.

Team members on a Studio Plus account see the studio's own records and nothing beyond them, through the same mechanism.

Card entry happens on the payment provider's own hosted checkout. Studio Ryzen never receives, stores or logs a card number, a CVV, a UPI PIN or a banking credential. At most we keep a provider token reference and the last four digits, so a saved card can be shown as "ending 4242".

When your client pays you by UPI, bank transfer, cash or cheque, the money moves directly from them to you and never touches Studio Ryzen. The UPI link we generate names your own VPA as the payee; we only record that you told us it arrived.

Card, netbanking and wallet payments run through your own payment gateway account, which you connect in Finance settings. The money settles to you on your provider's schedule. We sign the request on your behalf and are never the recipient.

Quotes, invoices, contracts and questionnaires are shared by a token in the URL, never a guessable id. A token opens exactly one booking: there is no list view behind it and no way to walk from one client's link to another's.

If a link is forwarded somewhere you did not intend, you can regenerate it from the booking, which invalidates the old one immediately.

Data is encrypted in transit, over HTTPS everywhere, and at rest by our hosting provider (Supabase, running on AWS).

Our own service credentials are held as server-side secrets. They are never compiled into the browser bundle, and a build-time check fails the release if a secret is ever given a client-visible name.

If you connect your own payment gateway, the secret half of those keys is encrypted before it is stored, using a key our database does not hold. A copy of the database on its own decrypts to nothing. Nobody can read the value back afterwards, including us: to change it you create a new key with your provider and reconnect.

Incoming payment webhooks are signature-verified before we act on anything they claim, so a forged message cannot mark an invoice paid. Each studio's events are checked against that studio's own secret, so one studio's provider messages cannot be forged for another.

Under India's Digital Personal Data Protection Act, 2023, Studio Ryzen is a Data Fiduciary and you are a Data Principal. You can:

• Get a copy of everything we hold about you
• Have inaccurate information corrected
• Have your data erased
• Withdraw consent as easily as you gave it
• Nominate someone to exercise these rights if you cannot

Export and deletion are available to you directly, without asking us, from Settings, then Account. For anything else, or if you would rather we did it, write to our Grievance Officer at support@studioryzen.com. We respond to any such request within 90 days, and in practice far sooner.

Deleting your account starts a grace period during which it can be restored, after which your data is removed. Before it goes, you can download a full export of your studio data. Financial records are kept for the life of the account because your books need to be reconstructable, not beyond it.

In the event of a personal data breach, we will notify the affected users without delay, describing what happened, what data was involved and what you should do. We will also report it to the Data Protection Board of India within 72 hours, as the DPDP Rules require.

If you believe you have found a security problem, please write to support@studioryzen.com rather than posting it publicly. We will acknowledge it and keep you informed.

Studio Ryzen has not been through a SOC 2 or ISO 27001 audit. Those are independent examinations that large companies' procurement teams require, and we have not paid for one. Everything on this page is our own description of how the product is built, not a third party's verdict on it.

We have not built saved cards or automatic recurring charges for your clients. Charging a card without someone present has its own rules under RBI's guidelines, and we would rather not offer it than offer it half-built.

We would rather say all of that plainly than let a badge imply something that has not happened. If you need audited assurance before using Studio Ryzen, tell us, and we will tell you honestly where we are.