This page is maintained by GuruMap to answer common security questions about the service. It describes controls we have in place today; it is not an independent certification.
Encryption
- All traffic between your browser and GuruMap is served over HTTPS (TLS).
- Data at rest in our database is encrypted on managed infrastructure.
Access control
- Every table containing user data uses row-level security so users can only read and write their own records.
- Reviews are public by design; only the review's author can edit or delete their entry.
- Server functions verify the caller's session before touching data.
Authentication
- Passwords are hashed and stored by our managed auth provider — we never store plaintext passwords.
- Sessions use short-lived tokens with refresh rotation.
Payments
- Card details are entered directly into Stripe's PCI-DSS Level 1 checkout; GuruMap never sees your full card number.
- Refunds, cancellations and payment method updates go through Stripe's Billing Portal, launched from inside the app.
User uploads
- Review photos and videos are stored in a dedicated bucket. Files are scoped to the uploader's folder; only the uploader can modify or delete them.
- We enforce file-size and format limits on upload.
Responsible disclosure
If you believe you've found a security issue, please email gurumapapp@gmail.com with reproduction steps. Please give us reasonable time to fix the issue before disclosing publicly.
Shared responsibility
You are responsible for keeping your account credentials safe, using a strong unique password, and reporting suspicious activity promptly.