SwapEazi
Price a paymentPrice
Security

Security

How to report a vulnerability, where your data is held, who processes it on our behalf, and what we will never ask you to do.

Effective: 7 August 2026Version 1.0

1. Reporting a security issue

If you have found a vulnerability in SwapEazi, tell us at security@swapeazi.io.

Include what you found, where you found it, and enough detail for us to reproduce it. A proof of concept helps. Please do not include real customer data in the report.

We acknowledge security reports within two business days. We will tell you what we intend to do and when, and we will tell you when it is fixed.

If you believe an issue is being actively exploited, say so in the subject line.

2. Hosting and data location

The SwapEazi website and application are hosted on Netlify. Application data is stored in Supabase, which runs on managed PostgreSQL. Both are confirmed from this codebase.

Where personal information is transferred outside South Africa, the transfer is made on the basis set out in our privacy policy.

3. Encryption

3.1 In transit

All traffic to swapeazi.io is served over HTTPS. HTTP Strict Transport Security is set with a two-year max-age, includeSubDomains and preload. A content security policy, X-Frame-Options DENY, X-Content-Type-Options nosniff and a restrictive Permissions-Policy are applied to every response. All confirmed from code in next.config.js and netlify.toml.

Connections to third-party services are made over TLS.

3.2 At rest

Data held in Supabase is encrypted at rest by the platform.

Secrets and API credentials are held as environment variables in the deployment platform and are not committed to source control.

4. Access control

Access to production data is limited to those who need it to operate the service.

The application uses separate database credentials for public and privileged access. The public client uses a restricted anonymous key; privileged operations use a service role key held server side only and never exposed to the browser. Confirmed from code in lib/db/supabase.ts.

Internal API surfaces are authenticated with HMAC-signed keys, and the signed-in documentation area is gated by an HMAC session cookie verified in edge middleware. Confirmed from code in middleware.ts.

5. Sub-processors

These are the third parties that process data on our behalf. Each is marked according to whether it is confirmed from this codebase.

5.1 In use

  • Netlify. Hosting, API, scheduled functions and the data store. Processes request data including IP addresses.
  • Supabase. Database for anonymised benchmark contributions, and records from the earlier payment service while they are deleted.
  • Resend. Transactional email, such as sending an API key. Processes name and email address.
  • Google Fonts. Typefaces are fetched at build time and self-hosted, so no visitor request reaches Google.

5.2 Switched off

The earlier payment service used identity verification, wallet and counterparty screening, AI-assisted payment review and licensed payout partners. Those parts of the service are closed and answer every request with an error, so none of those providers receives data from SwapEazi.

5.3 Changes

We tell customers before adding a sub-processor that will handle their data, and update this list and the Privacy Policy when we do.

6. Vulnerability disclosure and safe harbour

If you research in good faith under the terms below, we will not pursue legal action against you and we will not ask anyone else to.

6.1 What is in scope

  • swapeazi.io and its subdomains
  • The public API surfaces served from that domain

6.2 What we ask

  • Give us reasonable time to fix an issue before you tell anyone else about it
  • Do not access, modify or delete data that is not yours
  • Use test accounts and test data, and stop as soon as you have proved the issue
  • Do not degrade the service. No denial of service, no load testing, no spam
  • Do not use social engineering, phishing or physical access against our people or our suppliers
  • Tell us straight away if you access personal data by accident, and delete it

6.3 What we do not offer

We do not currently run a paid bug bounty. We will credit you publicly if you want us to, and we will tell you honestly what we did with your report.

Safe harbour does not extend to conduct that is unlawful independently of this policy, and it does not bind our hosting providers or our licensed partners, whose own terms apply to their systems.

7. What we will never do

Invoice fraud in cross-border trade almost always arrives as a convincing email about changed banking details. So that you can always tell, here is what we will never do.

  • We will never email you new banking details for a payment already quoted.
  • We will never ask for your online banking password or a one-time PIN.
  • We will never ask you to pay from a personal account or a third party's account.
  • We will never ask you to pay into an account in an individual's name.
  • We will never ask you to move a payment to a different account because of an urgent problem.

If you receive something that appears to be from us and does any of the above, do not act on it. Contact us on details you already have and assess. Then tell us, because if you received it, someone else did too.

Contact

Questions or requests under this policy: security@swapeazi.io