Security, stability & your data.
Who protects what under a Samektra-built site, what we do on every one of them, how payments stay off your servers, and — because nobody honest can promise a website will never fail — exactly what we do when something goes wrong. Plain language first; the contract says the same things in the language a court reads.
Who protects what
Your site runs on specialist providers, each responsible for a slice of the stack, with us responsible for how the pieces are put together — and a few choices that are yours.
They secure the buildings
Vercel runs the servers and absorbs attacks. Supabase runs the database and takes the backups. Stripe holds every card number. Each is independently audited (SOC 2 Type II and/or ISO 27001) and publishes a status page we watch.
We secure the locks and keys
The vendors give us the tools; using them correctly is our job. Row-level rules on every table, server-only keys, two-factor on every account, scheduled updates, off-site backups, monitoring, and a written incident plan.
You decide, and you hold your own keys
- Keep your own logins private and turn on two-factor when we hand you an account.
- Tell us the moment something looks wrong — a strange login email, a page you did not change.
- Decide what data the site may collect; you own it and what you publish.
- Keep a copy of anything you cannot afford to lose.
- Tell us before the site ever touches health, card or other regulated data so we can scope it properly.
The platforms under your site
Every claim below was read on the vendor's own security or compliance page on 2026-09-04; the link is on each card. Where a vendor does not publish something (a price, an SLA), we say so instead of guessing.
Vercel
Hosting, serverless functions, global CDN
- Servers, network and CDN your site is served from
- AES-256 encryption at rest; TLS 1.2 / 1.3 only in transit, HTTPS enforced
- Layer 3–7 DDoS mitigation on every plan; blocked traffic is not billed
- Team-wide two-factor enforcement on the studio account
Stability: Publishes a live status page; contractual 99.99% uptime SLA exists on Enterprise only, so we monitor availability ourselves.
Options: HIPAA Business Associate Agreement available on Pro (paid add-on) and Enterprise.
vercel.com/docs/security/compliance ↗Supabase
Database, authentication, file storage
- AES-256 encryption at rest; TLS in transit
- Daily backups with 7-day retention on Pro, 14-day on Team; point-in-time recovery add-on with a 2-minute recovery point
- Row-level security so each user can only reach their own rows — we enable it on every table
- Two-factor enforcement across the whole organization on paid plans
Stability: Live status page; 99.9% SLA on Enterprise only. Free-tier projects have NO backups — every paying client runs on Pro or above.
Options: Data pinned to a specific US or EU region on request; HIPAA BAA on paid plans with the required controls turned on.
supabase.com/docs/guides/security ↗Stripe
Card, wallet and bank payments
- Card numbers are entered inside a Stripe-hosted frame — they never touch your site or our servers
- Card data AES-256 encrypted in an isolated vault; TLS 1.2+ enforced
- Radar fraud screening runs on every payment from day one
- Passkeys / hardware keys on the studio Dashboard login; restricted API keys per integration
Stability: Stripe publishes a live status page and reports 99.999% historical uptime; no SLA is offered to standard accounts.
Options: Because the card form is Stripe-hosted, your site qualifies for the lightest PCI questionnaire (SAQ A), which Stripe helps you complete annually.
docs.stripe.com/security ↗Resend
Transactional email (receipts, form notifications)
- AES-256 at rest, TLS in transit
- Message content and logs retained 30 days, then deleted; can be switched off entirely as an add-on
- All stored data lives in the United States
Stability: Live status page; no published SLA.
Options: Zero-retention mode for sites that email sensitive content.
resend.com/security ↗GitHub
Source code + change history
- Mandatory two-factor for every contributor; organization-wide enforcement
- Push protection blocks secrets from being committed
- Complete history of every change to your site, forever
Stability: Your code is also cloned on our machines and deployed on Vercel — three copies at all times.
Options: The repository is transferred to your own GitHub account on request.
docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/about-mandatory-two-factor-authentication ↗Cloudflare / Namecheap
Domain registration + DNS
- Registrar lock and WHOIS privacy on every domain
- DNSSEC signed zones so nobody can redirect your domain
- Unmetered DDoS protection in front of DNS (Cloudflare, all plans)
- Two-factor on the registrar account; auto-renew with a valid card
Stability: A domain that lapses takes the site and email with it — renewal is on our calendar, not yours.
Options: Domain is registered in YOUR name; we hold delegated access, never ownership.
developers.cloudflare.com/registrar/ ↗What we do on every site
The studio layer. None of this is an add-on; it is the difference between a site that is hosted and a site that is looked after.
Row-level security on every table
The database enforces who can see what, even if application code has a bug. Powerful server-side keys never reach a browser.
Secrets stay secret
API keys live in encrypted environment variables marked sensitive, never in the code repository. Leaked keys are treated as compromised and rotated the same day.
Two-factor on every account we control
Vercel, Supabase, Stripe, GitHub, the registrar — enforced organization-wide, passkeys or hardware keys wherever they are offered. No shared logins.
Dependency + security updates on a schedule
Framework and library updates are reviewed, tested on a preview deployment, and shipped — the work a management plan actually pays for.
Backups you can restore from
Vendor backups plus our own off-site export of code, database and uploaded files under separate credentials. A backup nobody has restored is a rumor; we test ours.
Uptime monitoring we run ourselves
Because no plan below Enterprise carries a contractual SLA, we watch availability independently and subscribe to every vendor status page.
A written incident plan, per site
Detect, contain (rotate keys, pause, revoke sessions), assess, notify. If we confirm an incident touching your data, our target is to tell you within 72 hours of confirming it — sooner where Georgia law requires.
You own the keys
Domain, hosting, database and payment accounts are opened in your name with us as a delegated collaborator. Leaving is a permissions change, not a hostage negotiation.
Accepting payments on your site
Cards, Apple Pay, Google Pay and bank transfers, built as a custom feature on top of any tier. Card numbers stay with Stripe; we build the plumbing around them and keep it healthy.
How it works for your customers
- Customers pay on a Stripe-hosted page. Card numbers never touch your website or our servers.
- Because the card form is Stripe’s, your site qualifies for the simplest PCI questionnaire (SAQ A). What you still owe each year: the questionnaire itself and a quarterly external security scan — we do both with you.
- Bank transfer (ACH) costs about 0.8% capped at $5 versus 2.9% + 30¢ for cards. We turn it on by default so large invoices cost you less.
- Payments, refunds and disputes are mirrored into your site’s database by signed, replay-protected webhooks — your admin page always matches Stripe.
- Stripe screens every payment for fraud (Radar) from day one; we can require extra verification on risky orders only, so honest customers are not slowed down.
- We build the pages Stripe requires — refund and cancellation policy, contact details — so the account never gets paused.
- Surcharging is legal in Georgia with clear disclosure and card-brand caps, but we default to no surcharge and offer ACH as the cheaper rail instead.
- Georgia taxes parts, not separately-stated repair labor — invoices itemize the two. Confirm specifics with your accountant; we are not tax advisers.
Our rules for building it
- Hosted Stripe Checkout (full redirect) by default — the lightest PCI footprint there is.
- Restricted API keys with access policies per site; live and test keys never share an environment.
- Every webhook verified against its signing secret on the raw body; every event de-duplicated by ID.
- We store only what Stripe returns: brand, last four digits, expiry, receipt link. Never a card number.
- No custom card forms, ever. A custom form would put card data back on your site and you back in PCI scope.
Processor fees (Stripe, pass-through)
| Card, wallet (online) | 2.9% + 30¢ |
| Bank transfer (ACH) | 0.8%, capped at $5 |
| Card in person (Tap to Pay / reader) | 2.7% + 5¢ (+10¢ per Tap to Pay) |
| Invoicing | +0.4% per paid invoice, capped at $2 |
| Subscriptions (Billing) | +0.7% of recurring volume |
| Dispute | $15 per dispute |
Pay Online
Most land between $1,200 and $2,500
- Stripe-hosted checkout — card, Apple Pay, Google Pay, bank transfer (ACH)
- "Pay now" links + QR codes for quotes, deposits and invoices
- Receipts, one-click refunds, dispute alerts
- Payment records mirrored into your site’s database
- The refund / cancellation / contact pages Stripe requires
- Annual PCI questionnaire (SAQ A) walkthrough
Quotes & Invoices
Most land between $750 and $1,800
- Branded invoices with a hosted pay page (card + ACH)
- Automatic reminders, partial payments and payment plans
- Deposit-then-balance pattern for service jobs
- Labor itemized separately from parts (Georgia sales-tax friendly)
- Invoice status synced to your admin page
Memberships & Subscriptions
Most land between $2,500 and $6,000
- Recurring plans with automatic retries on failed cards
- Self-service customer portal — update card, change plan, cancel
- Members-only content or features gated by plan
- Failed-payment and cancellation handling
- Revenue and churn view on your admin page
Extras
| Deposits / holds (authorize now, capture on completion) | $500–$1,000 |
| Tap to Pay on your phone or a card reader for field techs | $300–$600 setup; reader from $59 |
| Automated sales tax (Stripe Tax) | $400–$800 setup; 0.5% per transaction to Stripe |
| Split payouts / marketplace (Stripe Connect) | Quoted separately, from $5,000 |
Payments monitoring — $49 / month
- Webhook health — failed deliveries caught before a payment goes missing
- Dispute alerts with evidence submitted within 48 hours
- Yearly PCI questionnaire + quarterly security scan handled with you
- Restricted-key review and Stripe API-change watch
- Monthly reconciliation export
Added to any management plan, or on its own for a site we did not build.
Stripe is the default because it keeps card data off your site, offers bank transfer at 0.8%, and runs in-person Tap to Pay from the same account. We build on Square instead when a client already runs Square point-of-sale. We are not tax advisers: sales-tax setup is confirmed with your accountant.
Options for regulated or high-value data
The defaults fit a service business. These are the dials for clients who need more, priced at vendor pass-through where the vendor publishes a price.
| Option | What it does | Cost |
|---|---|---|
| Point-in-time database recovery | Roll the database back to any moment, 2-minute granularity. | Supabase add-on: $100 / $200 / $400 per month for 7 / 14 / 28-day windows (pass-through) |
| Data residency | Pin the database to a specific US or EU region. | No charge; chosen at project creation |
| HIPAA Business Associate Agreement chain | For healthcare clients whose site or portal holds protected health information. Requires a BAA with us AND with each platform below us. | Vercel Pro BAA add-on $350 / month (pass-through); Supabase HIPAA add-on priced by Supabase on request; scoped as a Platform-tier build |
| Zero-retention email | Resend keeps no copy of message content. | Resend add-on $50 / month (pass-through) |
| Registry lock on the domain | Registry-level freeze on transfers and nameserver changes. | Namecheap Domain Vault, priced by registrar per TLD |
- Vercel and Supabase publish uptime history, not a contractual SLA, below their Enterprise tiers.
- Supabase Free projects have no backups at all — never host a paying client there.
- HIPAA is not a certification; it is an agreement chain. "HIPAA compliant" is not a thing we or any vendor can simply be.
- PCI scope follows the card data. Stripe-hosted forms keep it off your site; a custom card form would put it back on.
What we protect, and what we can't promise
No one can honestly guarantee that a website will never go down or never be attacked, and we will not pretend otherwise. Vercel, Supabase, Stripe and the other providers run under their own service terms; when one of them has an outage we are in the same boat as everyone else, and we tell you when it affects you.
What we can promise is how we work and how we respond. Every layer of your site is configured deliberately, reviewed on a schedule, and explained to you in plain language. If we confirm a security incident affecting your data, we tell you promptly — our target is within 72 hours of confirming it, and faster where Georgia law sets a shorter clock — help you understand what happened, and work to restore your site from backup.
We build and maintain websites. We are not HIPAA, PCI, ADA or legal compliance consultants, and no website we build is a certification of your business. If your site will handle protected health information, cardholder data or other regulated data, tell us before we start so we can scope it properly or point you to the right specialist.
Every engagement runs under a written Website Services Agreement. It says the same things this page says, in the language a court reads: commercially reasonable safeguards, no warranty of uninterrupted or breach-free service, platform providers responsible for their own layers, and a limit on our liability tied to the fees you have paid us.
The agreement, in plain language
Every build and management plan runs under a written Website Services Agreement. These are its security, data and liability terms as we would explain them across a table. The signed agreement governs if the two ever differ.
Our safeguards
Commercially reasonable administrative, technical and physical measures appropriate to the data involved: two-factor on our accounts, least-privilege access, encryption in transit, scheduled security updates, periodic backups.
No guarantee of security or uptime
We do not warrant that the site will be uninterrupted, error-free, or free from unauthorized access. We warrant how we work, not that the internet is safe.
Platform providers own their layer
Vercel, Supabase, Stripe and Resend are governed by their own terms and service levels. We configure them per their published guidance; we are not liable for their outages, breaches or price changes.
Your responsibilities
Your credentials and two-factor, everything done under your accounts, the legality of your content and data collection, your own regulatory compliance, and independent copies of critical data.
Backups and restore
Backups at the frequency in your order; on request or after an incident we use commercially reasonable efforts to restore from the most recent good backup. Restoration is the remedy for data loss.
Incident notice
If we confirm unauthorized access to your unencrypted data in our control, we notify you without undue delay — target 72 hours from confirmation, shorter where Georgia's 24-hour custodian rule applies. Notices to your customers or regulators are yours to make; we help.
Regulated data
No health, card or other regulated data on the site unless your order says so and the required agreements (for example a HIPAA BAA) are signed. Card data is handled by Stripe; we never receive it.
Limit of liability
Neither side is liable for indirect or consequential damages (lost profits, lost data value, reputational harm). Our total liability is capped at the fees you paid us in the prior twelve months, with the usual carve-outs for gross negligence, willful misconduct and fraud.
Your data, returned
You own your content and data. For 30 days after termination we export it in a standard format and transfer your accounts and domain; after that we delete what we hold.
This page is a plain-language summary, not legal advice and not the agreement itself. Georgia's breach-notification law is O.C.G.A. §§ 10-1-910 to 912; if your business has its own obligations under it, or under HIPAA, PCI DSS or the FTC Act, those remain yours.