Trust & security

Accounts

• Sign-in is run by Clerk, a company that specialises in logins. One Futels account works across futels.com and its apps, such as Futels Education.
• You can sign in with email and password, a one-time email code, Google, or your phone. Passwords are kept by Clerk, never by Futels, and only in hashed form.
• Two-step login with an authenticator app, plus backup codes, is available in Account and security.
• Clerk confirms your email address or phone number before the account is used.
• In Account and security you can see the devices you’re signed in on and sign any of them out.
• Deleting your account removes it from Clerk, and any data stored with your account is deleted from our database at the same time.

On the web

• Everything is served over HTTPS, with HTTP Strict Transport Security.
• Pages can’t be embedded in other sites (clickjacking protection), browsers are told not to guess file types, and links don’t leak full addresses to other sites.
• Camera and microphone access are switched off for the whole site. Location is too, except in the ফসলবন্ধু farmer app, which can ask for your approximate location to show the local weather.

Payments

• Payments are not switched on yet. When they are, card, bKash and Nagad payments will go through SSLCommerz, a Bangladeshi payment gateway. Card details never touch Futels’ servers, and Futels never holds customers’ money.
• Payment notifications from the gateway will be accepted only after their signature is checked.

Data and providers

We use Vercel for hosting, Clerk for sign-in, MongoDB Atlas for the database, Resend for email and, once payments are switched on, SSLCommerz for payments. We don’t sell data and don’t use advertising or tracking cookies. Full details are in the privacy policy.

Still in progress

Being clear about what isn’t done yet is part of trust. Accounts open with the beta. Futels doesn’t hold certifications such as SOC 2 or ISO 27001 yet, and doesn’t have an independent security audit yet.

Report a vulnerability

If you find a security problem, email support@futels.tech with the steps to reproduce it. We aim to reply within three working days.

• Test only against your own account, and don’t access, change or delete other people’s data.
• No denial-of-service, spam or social engineering.
• Give us reasonable time to fix the issue before sharing it publicly.

We won’t take action against anyone who reports a problem in good faith under these rules. Our contact details are also in machine-readable form at /.well-known/security.txt.