Security

Effective date: 28 August 2026

We don't claim any formal security certification (no SOC 2, ISO 27001, or PCI-DSS claim is made here or anywhere on Unio). What follows describes the actual measures in place today.

Account security

Unio uses phone-number OTP login — there are no passwords to leak or reuse. OTP requests and verification attempts are rate-limited per phone number and per network address, and failed-login messages are worded identically regardless of the reason, so the login flow can't be used to check whether a phone number has an account.

Data access

Every table in our database has row-level security enabled, scoping what each type of user can read or write at the database layer — not just in the app's UI. For example, a student can only read or delete their own saved listings; only an owner's own listing rows are writable by them; sensitive columns (like an owner's internal review notes) are never exposed to the public API at all.

Uploads

Listing photos are uploaded to a private storage bucket, restricted to image files under 5MB, and only ever readable through short-lived signed links — not public URLs.

Browser-level protections

We set a strict Content Security Policy, and standard hardening headers (HSTS, clickjacking protection, MIME-sniffing protection, and a restrictive permissions policy that blocks camera/microphone access and restricts location access) on every response.

Admin access

Access to the admin review tools is restricted to a fixed, small list of authorised accounts, checked on every admin page and every admin action — not just once at login.

Reporting a security issue

If you've found a security problem, please don't test it on real user data or disrupt the service — instead see our Responsible Disclosure page and email contact@myunio.in.