Passwords
Passwords are never stored in readable form. They are hashed using PBKDF2-SHA256 with a unique random salt and 120,000 iterations.
Security
A plain-language summary of how passwords, sessions, file access, and transport security are currently handled.
Passwords are never stored in readable form. They are hashed using PBKDF2-SHA256 with a unique random salt and 120,000 iterations.
Logged-in sessions use a cryptographically signed cookie. In production, the cookie is marked `Secure`; it is `HttpOnly`, expires after 30 days, and is rejected if it is forged, tampered with, or expired.
Uploaded bills, warranty cards, and product photos are stored on a private server and are served only through authenticated routes tied to the owning account.
Communication between browser and server is intended to run over HTTPS in production. Data sent to the external AI extraction provider is also transmitted over HTTPS.
When you use the photo-capture flow, the submitted image may be sent to an external AI API for structured extraction. That is the main point where image data leaves the WarrantySafe server.
If you discover a security issue, report it responsibly to sales@qubixvirtual.in with the subject line Security Vulnerability. We aim to acknowledge valid reports within 72 hours.