SmartersWeb SI uses server-side payment integrations, account-bound access controls, protected sessions, encrypted supported credentials, and auditable application events. This page explains the controls implemented by the platform without claiming certifications we have not earned.
Authenticated areas use server-managed sessions with secure cookie controls, session rotation, idle limits, absolute lifetime limits, CSRF protection on state-changing forms, role checks for client and administrative routes, and optional standards-based TOTP two-step verification with one-time recovery codes.
Production API credentials are expected in server environment configuration rather than browser code. Supported user-provided AI credentials and social connection tokens use the platform encryption layer before storage.
Plan selection, checkout state, entitlement verification, subscription history, and reconciliation are handled inside SmartersWeb SI. PayPal account authentication and subscription approval occur on PayPal-controlled pages; PayPal credentials are not collected by SmartersWeb SI.
PayPal subscription and payment events are accepted through the server webhook integration and are verified before provider status is used to update local billing state.
The platform sends defensive browser headers, blocks direct access to common configuration and backup file types, uses same-origin protections for sensitive actions, and separates public pages from authenticated workspace routes.
Application records are scoped to authenticated users or authorized administrators. Operational logs and audit records are used to diagnose platform activity and security-sensitive actions.
Please avoid accessing data that does not belong to you, disrupting the service, or publicly disclosing a vulnerability before it can be investigated. Send a clear description, affected URL, reproduction steps, and relevant evidence to hello@smartersweb.com.
Last updated: October 18, 2026. Security controls continue to evolve with the platform.
