Sutrana protects marketplace trust through implemented controls: secure accounts, email verification and password reset readiness, MFA/TOTP readiness, session revocation, server-side access checks, public-safe API responses, audited admin and integration changes, payment webhook verification when provider secrets are configured, signed digital downloads, upload safety status, affiliate/self-purchase/payout risk signals, privacy export and account-deletion review, content/IP abuse reporting, and clear support paths. Local development keeps secrets in environment-managed configuration; production secret storage is designed to move to a dedicated vault such as Azure Key Vault. This page does not claim external certifications, audits, or compliance status.
Accounts
Passwords are hashed, login/register/reset routes are throttled, email verification and session revocation are supported, MFA/TOTP readiness exists, mobile tokens use secure storage, inactive users are blocked, and security events are recorded without raw secrets.
Public APIs
Search length, page size, and query parameters are bounded. Responses include only marketplace-safe data and never include secrets, admin notes, private contacts, or private file paths.
Commerce
Webhook signatures are verified when provider secrets are configured. Paid downloads require entitlement checks, signed temporary links, limits, and file safety status.
Fraud
Click spam, self-purchase attribution, high-risk payout patterns, content abuse, and IP reports create admin-visible risk signals without exposing internal rule details publicly.
Privacy
Users can request privacy exports and account deletion review. Exports avoid social tokens, provider payloads, private files, payment secrets, and admin notes.
Operations
Admin changes, integration visibility changes, notifications, moderation, payout, commission, and dispute decisions are tracked through audit logs with secret values redacted.
Secrets
Development secrets stay in environment-managed configuration. Production activation should use a dedicated vault such as Azure Key Vault and must not place secret values in CMS pages or public platform settings.