Security

UniDoodle runs on Lovable Cloud with data stored in a managed Postgres database. Traffic is encrypted in transit with TLS. Backups and point-in-time recovery are managed by the platform.

• Row-level security policies on every user-owned table.
• Role separation between students, teachers and organisations.
• Server-side authentication with per-request middleware for privileged operations.
• Least-privilege service credentials for background jobs.

All card payments are handled by Stripe (PCI-DSS Level 1). Webhook signatures are verified before any subscription state change.

If you believe you have found a security issue, please email security@unidoodle.com. Please give us a reasonable time to remediate before public disclosure. We aim to acknowledge reports within five working days, keep you updated while we investigate, and will not pursue action against researchers who report in good faith and avoid accessing other people’s data.