Security
Stay Spine is a demo today. It holds illustrative data, and it sends no real messages or payments. A lawyer has not yet reviewed this page. It is written in plain words so you can see our intent, and it is not a final legal document.
What is in place
Each workspace is walled off in the database, with row-level rules that refuse access unless a request carries the right workspace.
Staff and guest links are random, stored as hashes, and stop working the moment they are revoked.
Support needs a reason to open a workspace. Access lasts 30 minutes and appears in the owner's access log. Support cannot see guest IDs or message content.
How IDs are handled
Aadhaar QRs are checked on the phone. Only a yes or no on the signature and name, and an age band, leave the device. No Aadhaar image or number is kept.
Reading photos of other IDs is switched off outside the demo's sample documents, until a lawyer has checked it.
What we do not claim
We hold no security certification, and we do not claim GDPR or SOC 2 compliance. If that changes, this page will say so, with the evidence.
Telling us about a problem
If you find a security problem in the demo, please tell Millennial AI so we can fix it.