SparkyMinis Security Architecture and Data Protection Guide
Security & Zero-Access Architecture
SparkyMinis is engineered around a Zero-Access principle: your data is technically inaccessible to anyone other than you — including our own staff. This is not a policy promise; it is enforced at the database engine level.
1. Row-Level Security (RLS)
Your data lives in a shared cloud database, but it is invisible to everyone but you.
- The Lock: Every row in the database — every invoice, expense, trip, note, contact — is stamped with your unique User ID (
uid). - The Key: The database engine validates your authentication token on every single read or write request.
- The Result: If a support engineer runs
SELECT * FROM invoicesin their admin console, they see zero results — because their token doesn't match your user ID.
RLS is enforced at the Cloudflare D1 layer, below the application code. Even if there were a bug in the application, the database itself enforces the boundary.
2. Support Access Protocol
We cannot "Login as You." There is no backdoor, no super-admin button, and no shadow copy of your session.
If you need hands-on debugging support:
- Assisted debugging: You share a sanitised Support Bundle (a JSON export with sensitive values redacted) or share your screen with us during a scheduled call.
- No standing access: No SparkyMinis employee has permanent access to production user data.
- Temporary debug tokens: In exceptional cases (e.g., a billing issue), a one-time scoped token may be issued — only with your explicit written consent, for a specific record, for a defined time window, with a full audit trail.
3. Vault Encryption
Files stored in your Secure Vault receive two layers of protection:
| Layer | Mechanism |
|---|---|
| At Rest | AES-256 encryption before writing to storage |
| In Transit | TLS 1.3 for all uploads and downloads |
| Access Control | Files linked to your uid — inaccessible without your session |
Even if physical hardware were compromised, the encrypted data would be unreadable without the per-user encryption key.
4. Authentication
SparkyMinis uses Firebase Authentication with Google and Microsoft OAuth:
- There are no passwords stored in SparkyMinis — login is handled entirely through your Google or Microsoft account.
- Login sessions use short-lived Firebase JWT tokens. Tokens expire and are automatically refreshed.
- Revoking access is done through your Google or Microsoft account settings — removing SparkyMinis from connected apps immediately invalidates your session.
5. AI Data Boundaries
AI features operate within strict data boundaries:
- The AI assistant only receives your own data — never data from other users.
- No personally identifiable information (names, emails, addresses, invoice amounts) is sent to external AI providers.
- Only anonymised numerical patterns are involved in cloud AI processing, and only if you have enabled that feature.
- Full details in the AI Suggestions & Privacy guide.
6. What We Store vs. What We Never Store
| We Store | We Never Store |
|---|---|
| Encrypted file contents | Passwords (we use OAuth — no passwords exist) |
| Hashed user ID references | Raw card numbers or bank credentials |
| Anonymised analytics (page views) | Chat or support conversation contents |
| Your account email | Auth tokens beyond the current session |
Payment processing is handled entirely by Razorpay (India) and Stripe (international). SparkyMinis never touches card data — it goes directly from your browser to the payment provider.
7. Account Deletion
Requesting account deletion permanently removes all your data from SparkyMinis servers within 30 days, in compliance with GDPR and India's DPDPA.
Navigate to: Settings > Security & Privacy > Delete My Account & Data
Export your data first using the Data Portability guide before deleting.