Access
Authenticated workspaces
Private reports, messages and documents are delivered through signed, secure browser sessions. Administrative and client permissions are checked by the server, not trusted to browser controls.
Security & data protection
Your sourcing decisions are private work.
SinoSource separates public research from private client workspaces, limits who can reach client records, and treats uploaded evidence as untrusted until it has passed the applicable checks. This page explains the controls and the limits without claiming certifications we do not hold.
Documents
Protected evidence vault
Client files use random storage names outside the public web root and are returned only through an ownership-checked download handler. Uploads are checked by size, extension, detected content, file signature and archive-expansion limits before malware scanning.
Continuity
Encrypted backups
Database backups are encrypted before off-site transfer. Recovery procedures include an isolated restore workflow so a backup is tested before it is trusted as recoverable.
Application boundaries
Public website
Marketing pages and public research are intentionally separated from authenticated client and operator actions. Public pages may load optional analytics or support tools only after consent.
Client portal and admin
Authenticated areas use restrictive caching and do not load optional marketing analytics or live-chat code. Sensitive actions are authorised again at the API boundary.
Administrator authentication
Every administrator uses a named account. Production sign-in requires TOTP multi-factor authentication; an unenrolled account can enter only the short-lived enrolment flow. Recovery codes are one-use, sessions are individually revocable, and successful sign-ins generate an email alert.
Password screening
New passwords are checked against known breach data through the k-anonymous Pwned Passwords range protocol. Only the first five characters of a SHA-1 hash are sent; the password and complete hash do not leave SinoSource.
Payments
Card details are handled by Stripe. SinoSource receives subscription and payment status; it does not store full payment-card numbers or CVC values.
AI-assisted tools
Where an AI-assisted feature is used, prompts are routed through controlled server-side services. Client data should be minimised to what the requested task needs, and AI output is not treated as verified evidence by itself.
Data lifecycle
Collection
We collect the contact, onboarding, supplier, evidence and operational information needed to deliver the agreed service. The full categories and lawful bases are described in the Privacy Policy.
Retention and deletion
Self-service account deletion removes the individual sign-in identity and disconnects it from client workspaces. It does not silently erase organisation-owned or shared reports, documents, evidence, sourcing activity, or financial records. Workspace erasure is a separate, authority-checked request, and retention periods and legal exceptions are stated in the Privacy Policy.
Service providers
Hosting, payments, email, account sign-in, optional public-site analytics/support and AI-assisted processing depend on disclosed service providers. The current list and international-transfer information appear in the Privacy Policy.
What clients control
Use unique account credentials
Do not share portal access, reuse passwords from other services, or send client access information through public channels. Report suspected access immediately.
Upload only necessary material
Remove unrelated personal data and secrets from supplier documents before uploading. Do not upload executable software, password databases or documents you are not authorised to share.
Independently verify commercial commitments
Security controls protect the workspace; they do not make a supplier claim true. Testing, contracts, banking verification and regulatory decisions remain separate checks before funds move.
Current assurance limits
No external security certification
The platform has not yet completed SOC 2, ISO 27001 or an independent penetration test. Automated release checks and operator review reduce risk; they are not a substitute for external assurance.
MFA needs operational enrolment
The release contains enforced TOTP enrolment, replay protection, one-use recovery codes and login alerts. Each production administrator must still complete enrolment on a real authenticator and store the recovery codes safely; the owner health panel reports the live enrolment count.
Scanning depends on production configuration
Evidence uploads fail closed when validation or configured malware scanning cannot establish an acceptable result. The operator health panel reports whether the scanner and outside-root vault are active.
Report a security concern
Email info@getsinosource.com with “Security report” in the subject. Include the affected URL, when you observed the issue and reproducible steps. Do not include passwords, private keys, full payment details or unnecessary client data. We will preserve relevant records, triage the report, contain confirmed exposure and notify affected parties or authorities where legally required.
Last reviewed: 14 August 2026. This page describes operational controls; it is not an independent audit report or certification. Material changes to processors or handling practices are reflected in the Privacy Policy.