Security

• Passwords are stored as bcrypt hashes and are never recoverable in plain text — not by us, not by support.
• Repeated failed sign-ins lock an account temporarily, and the lock lengthens under sustained attempts.
• Changing your password, changing your sign-in email, or requesting deletion signs out every device immediately.
• Every successful sign-in is recorded with its time, IP address and browser, and shown to you under Settings.
• Email changes are confirmed from the new address and announced to the old one, so a change cannot be made silently.

Card numbers, CVVs and UPI credentials never reach our servers. Payment is handled by Razorpay; what we store is a token handle and the last four digits needed to render the row.

Payment outcomes are confirmed from Razorpay's signed webhooks rather than from the browser, and every webhook is signature-verified and replay-protected before it can move money.

• Traffic is served over HTTPS, and the database connection is encrypted in transit.
• Project files are private. They are reachable only through short-lived signed links, issued after checking that you are party to the project.
• Uploads are validated by their actual content rather than by the filename or the type the browser declares.
• Access to a project, milestone or file is re-checked on the server for every request; nothing is decided in the browser.

• A strict Content-Security-Policy with per-request nonces, so injected script does not execute.
• Same-origin enforcement on every state-changing request.
• Rate limits on authentication, uploads, payments and public forms.
• Privileged and money-moving actions are written to an append-only audit log.

If you have found something, write to security@pixirain.com. Include what you did, what happened, and enough detail to reproduce it.

We will acknowledge within 3 business days and keep you updated until it is closed. We will not pursue action against anyone who reports in good faith, stays within their own test accounts, does not access or modify other people's data, and gives us reasonable time before publishing.

There is no paid bug bounty programme at present. Please do not run automated scanners against the live site — see the Acceptable Use Policy.

If a breach affects your personal data, we will tell you what happened, what was involved and what to do about it, and notify the relevant authority where we are required to. We do not make claims about holding security certifications or completing external audits; where that changes, this page will say so and name the certification.