Security at Presenvo

Our approach

Presenvo separates public marketing and generated-site traffic from authenticated dashboard and administrative routes. Server-side checks protect account, site, billing, and administration actions.

Security controls reduce risk but cannot eliminate it. If you notice a potential issue, please report it privately.

Encryption

• In transit. The production application and published sites are served over HTTPS. Custom-domain certificates are provisioned through the domain provider.
• Stored credentials. Provider API keys and other supported administrative secrets stored by the application are encrypted with AES-256-GCM before they are written to the database.

Access control

• Dashboard requests require an authenticated and verified user.
• Site and billing operations are scoped to the current account on the server.
• Administrative routes use a separate role check.
• Selected administrative actions are recorded in an audit log.

Authentication

Accounts can sign in with email and password. Email verification is required, password reset links expire after 30 minutes, and resetting a password revokes existing sessions. Password handling and hashing are provided by Better Auth.

Sessions expire after seven days and are refreshed at most once per day while active. Authentication endpoints use server-side rate limits, and CAPTCHA checks can be enabled for login, signup, and password-reset requests.

Payments

Checkout and payment collection are handled by Razorpay. Presenvo records the identifiers and billing records needed to verify payments, manage subscriptions, and show payment history; it does not ask you to enter a full card number or CVV into a Presenvo form.

AI providers

We send review text and business details to third-party AI providers to generate your site content. The active provider is selected from the providers configured by the service. Provider processing is also governed by that provider's terms and privacy practices; see our Privacy Policy for the categories of data involved.

Incidents

The application records operational errors and selected security-relevant actions so they can be investigated. If an incident affects personal data, we will assess it and provide notices required by applicable law.

Responsible disclosure

If you believe you have found a security vulnerability inPresenvo, please report it to [email protected]. Include a description of the issue, steps to reproduce, and any supporting material.

We ask that you:

• Give us a reasonable time to investigate and fix the issue before public disclosure.
• Avoid privacy violations, service degradation, or data destruction while testing.
• Do not exploit findings beyond what is necessary to prove the issue.

We will review reports sent to this address. Presenvo does not currently operate a paid vulnerability bounty program.

Contact

Security reports: [email protected]. Everything else: [email protected].