Security

• Every record belongs to one company workspace. Row Level Security rules inside the database check, on every read and write, that the signed-in user is a member of that workspace. A bug in a web page cannot show one company's data to another.
• Plan limits and branding rules are enforced in the database as well as the app, so they cannot be bypassed.
• An automated test suite checks these rules, including that companies cannot see or change each other's data.

• All traffic to Show Day HQ uses HTTPS (TLS).
• The database and uploaded files are hosted by Supabase in India (Mumbai region) and encrypted at rest.
• The database is backed up automatically. Backups are encrypted and roll off within 30 days.

• Passwords are never stored in readable form, only as a strong one-way hash. Nobody, including us, can see your password.
• Sign-in sessions use secure cookies that are only sent over HTTPS and expire automatically.
• Inside a company, owners, admins and members have different permissions. Only owners and admins can manage the team, branding and domains. Only owners can delete the company.
• People invited to a show (on-ground managers, crew, organisers) get a Show Day–only login and cannot see the rest of your company's data.

• Proposal and show links use long random codes that cannot realistically be guessed.
• A link shows only that one proposal or show, and only while it is published. Unpublish or delete it and the link stops working straight away.
• Rider download links and calendar subscription links also use long random codes, and only show what they were made for.
• Show documents can be limited to managers, and on-ground team logins only see the shows they were added to.

• No one at The Right Management, including our developers, opens or reviews customer data, except at a customer's written request for support, where Indian law requires it, or to deal with a security incident.
• The keys that can bypass database security are kept only on the server, never sent to browsers, and limited to the few tasks that need them, such as setting up custom domains and changing plans.
• Our admin tools manage subscriptions. They are not built to browse customer data.

Deleting a company removes all of its records and uploaded files immediately. When a subscription ends, data is deleted after 30 days. See the Privacy Policy for full retention details.

We monitor for problems and have a plan to contain, investigate and recover from incidents. If a breach affects your data, we notify you without delay, and report to the Data Protection Board of India as the law requires. See the Data Processing Terms.

• Use a strong, unique password and never share your login. Give each team member their own account.
• Remove team members who leave, and give admin access only to people who need it.
• Only share proposal and show links with the people who need them, and unpublish them when they are no longer needed.
• Do not store bank or card details in the Service. Mark identity documents for managers only and delete them after the show.

If you think you have found a security issue, email info@therightmanagement.in with the details. Please give us reasonable time to fix it before sharing it publicly, and do not access other people's data, disrupt the Service or run automated scans. We will not take legal action against good-faith research that follows these rules.