Security at GrowBro

Data handling

GrowBro processes customer content — messages exchanged through WhatsApp, Instagram, Messenger, website widgets, leads in the CRM, and AI assistant transcripts — strictly to deliver the features you configure. We never sell your data and never use it to serve advertising.

• Customer data is logically isolated per account using Postgres row-level security in our managed database.
• Access to production data is limited to a small number of authorised engineers, gated by SSO, multi-factor authentication, and audited session logging.
• We do not use Customer Content to train GrowBro’s own AI models. Our LLM provider (OpenAI) does not use API inputs or outputs to train its models under its standard API terms.
• You can request deletion at any time via the Data Deletion page or in-app account settings.

Encryption

• In transit: all customer-facing endpoints require TLS 1.2 or higher and enforce HSTS.
• At rest: data in our managed Postgres database and object storage is encrypted with AES-256 by Supabase using cloud-provider key management.
• Secrets: API keys, OAuth tokens, and integration credentials are stored in encrypted columns with server-side access only.

Authentication

• Customer authentication via email + password or Google SSO, with bcrypt-style password hashing and rate-limited login attempts.
• Multi-factor authentication is available and recommended for all account holders.
• Session tokens are signed JWTs with short lifetimes and refresh-token rotation.
• OAuth tokens for connected integrations (Google, Meta, HubSpot) are stored encrypted server-side and revoked when you disconnect.

Application security

• Code review: all changes are reviewed before merging to the production branch.
• Dependency scanning: automated vulnerability scanning runs on every push, blocking high-severity CVEs.
• Webhook verification: incoming webhooks from Meta, Razorpay, and other platforms are cryptographically verified using HMAC signatures before processing.
• Input handling: we use parameterised queries throughout and rely on framework-level XSS protections in the React frontend.
• Vulnerability response: we target patching of critical vulnerabilities as soon as a fix is available, with high-severity issues addressed in the following sprint. Specific timelines are documented internally and available to enterprise customers on request.

Infrastructure

• Hosting: the GrowBro CRM runs on Vercel; our database, authentication, and object storage are operated by Supabase. Both providers operate under SOC 2 and ISO 27001 attestations of their own.
• Environment segregation: production, staging, and development environments use separate accounts, credentials, and data stores.
• Network protection: public endpoints sit behind Vercel and Cloudflare-grade DDoS protection.
• Monitoring: automated monitoring runs continuously with alerts to the on-call engineer for elevated error rates, anomalous auth events, and platform integration failures.

Data residency & sub-processors

Customer data is stored primarily in our Supabase project located in ap-south-1 (Mumbai, India). Web hosting runs on Vercel’s global edge network. Messages to and from third-party platforms transit those platforms’ infrastructure (Meta, Google, Razorpay).

Current sub-processors include: Supabase (database, auth, storage), Vercel (web hosting), Meta (WhatsApp Cloud API, Instagram, Messenger), Google (Sheets, Calendar OAuth), OpenAI (AI assistant inference), Razorpay (payments), and our transactional email provider.

A current list is available on request from privacy@growbro.ai. Enterprise customers receive advance notice of new sub-processors under their Data Processing Agreement.

Privacy & regulatory alignment

We implement controls designed to meet the obligations of the following frameworks. We do not currently hold formal third-party certifications; where used below, “aligned with” means our practices follow the framework’s principles, not that we have been audited against it.

• DPDPA 2023 (India): aligned with the Act’s Data Fiduciary obligations, including grievance redressal, breach notification, and reasonable security safeguards under the IT (Reasonable Security Practices) Rules, 2011.
• GDPR / UK GDPR: aligned with controller and processor obligations, including Standard Contractual Clauses for cross-border transfers and a Data Processing Agreement for enterprise customers.
• CCPA / CPRA (California): we honour consumer rights to know, delete, correct, and limit use of sensitive personal information; we do not sell or share personal information for cross-context behavioural advertising.
• Meta Business Platform: GrowBro is a Meta Business Partner and follows Meta Platform Terms and the WhatsApp Business Messaging Policy.
• PCI DSS (payments): we do not store full payment card data. Card data is collected and stored by Razorpay, a PCI DSS Level 1 certified processor.

Incident response & breach notification

• We maintain a documented incident response plan and conduct internal post-incident reviews.
• Where a personal data breach has occurred, we will notify the Data Protection Board of India and any other competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware.
• Affected customers will be notified without undue delay where the breach is likely to result in a material risk to their data subjects.

Backups & continuity

• Automated daily backups of the primary database, retained on a 30-day rolling window.
• Point-in-time recovery available on Supabase paid tiers within their stated RPO/RTO.
• Code, infrastructure-as-code, and secrets are stored in version-controlled, replicated systems.

Employee practices

• All employees and contractors are bound by confidentiality obligations and an acceptable-use policy.
• Access to production systems requires SSO and MFA, and is revoked the same day on offboarding.
• Security awareness guidance is shared during onboarding and updated as threats evolve.

Responsible disclosure

If you discover a security vulnerability in GrowBro, please email security@growbro.ai with a clear description, reproduction steps, and your contact details. We will acknowledge receipt within 3 business days.

Good-faith research that respects the following rules will not be the subject of legal action: do not access, modify, or destroy customer data; do not run automated scanners that degrade service; do not publicly disclose the issue before we have had a reasonable opportunity to fix it (we target 90 days). We do not currently operate a paid bug bounty programme.