Trust & security

Accounts

• Sign-in is run by Clerk, a company that specialises in logins. One Futels account works across futels.com and its apps, such as Futels Education.
• You can sign in with email and password, a one-time email code, Google, or your phone. Passwords are kept by Clerk, never by Futels, and only in hashed form.
• Two-step login with an authenticator app, plus backup codes, is available in Account and security.
• Clerk confirms your email address or phone number before the account is used.
• In Account and security you can see the devices you’re signed in on and sign any of them out.
• Deleting your account removes it from Clerk, and the approval requests you sent are deleted from our database at the same time.

On the web

• Everything is served over HTTPS, with HTTP Strict Transport Security.
• Pages can’t be embedded in other sites (clickjacking protection), browsers are told not to guess file types, and links don’t leak full addresses to other sites.
• Camera and microphone access are switched off for the whole site. Location is too, except in the ফসলবন্ধু farmer app, which can ask for your approximate location to show the local weather.

Your clients’ work

• Each request has its own link containing a random code, and only you see your requests in your dashboard.
• Anyone with a request’s link can open it, so share it only with your client.

Payments

• Card payments are handled by Stripe. Card details never touch Futels’ servers.
• Payment notifications from Stripe are accepted only with a valid signature.

Data and providers

We use Vercel for hosting, Clerk for sign-in, MongoDB Atlas for the database, Resend for email and Stripe for payments. We don’t sell data and don’t use advertising or tracking cookies. Full details are in the privacy policy.

Still in progress

Being clear about what isn’t done yet is part of trust. Accounts open with the beta. Futels doesn’t hold certifications such as SOC 2 or ISO 27001 yet, and doesn’t have an independent security audit yet.

Report a vulnerability

If you find a security problem, email hello@futels.com with the steps to reproduce it. We aim to reply within three working days.

• Test only against your own account, and don’t access, change or delete other people’s data.
• No denial-of-service, spam or social engineering.
• Give us reasonable time to fix the issue before sharing it publicly.

We won’t take action against anyone who reports a problem in good faith under these rules. Our contact details are also in machine-readable form at /.well-known/security.txt.