Last updated: June 2026
All data transmitted between your browser and SUQ is encrypted in transit using TLS 1.3. Data at rest is encrypted using AES-256, enforced at the database layer via Turso. This applies to all account data, product listings, order records, and transaction history.
Passwords are hashed using bcrypt before storage — we never store plaintext credentials. Session tokens are cryptographically signed and expire after 30 days of inactivity. We support Google OAuth 2.0 and magic-link sign-in as passwordless alternatives, both of which bypass credential storage entirely.
SUQ is hosted on Vercel, which maintains SOC 2 Type II certification and operates a global edge network with DDoS protection and automated failover. Our primary database runs on Turso with point-in-time automated backups. Static assets and uploaded media are served through Cloudflare R2, which provides redundant object storage with global CDN delivery.
All payment processing is handled by Stripe, which is certified at PCI DSS Level 1 — the highest level of compliance available in the payments industry. Card numbers, CVV codes, and bank account details are entered directly into Stripe-hosted fields and never touch SUQ's servers. We store only the opaque payment method identifiers that Stripe provides for recurring billing.
Data access is scoped strictly by account type. Sellers can only access their own storefront data, product listings, and order records. Buyers can only access their own purchase history and quote threads. There is no mechanism by which one account can view another account's data. All access control is enforced at the API layer, not just in the UI.
If you discover a security vulnerability in SUQ, please report it to security@suq.et. We ask that you give us a reasonable opportunity to investigate and address the issue before any public disclosure. We commit to acknowledging all reports within 48 hours and keeping you informed as we work toward a resolution. We do not pursue legal action against researchers who report vulnerabilities in good faith.
For security-related questions or to report a concern, contact us at security@suq.et.