Security and Client Data

A practical overview of how MarGioM treats request tracking, client portal access, private files, payment proof, admin notes, and project communication.

Ask a security questionRead privacy policy
Private request tracking
Request ID and Access Code tracking is used before a requester becomes a verified client.
  • Clients can follow request status without an open public account.
  • Access codes should be stored as hashes, not readable plain text.
  • Tracking views should not expose admin notes or other client data.
Invite-only client portal
Full project execution should happen only after proposal approval, signed agreement, and verified deposit.
  • Client portal access is invite-only.
  • Clients should only see projects linked to their account.
  • Admin-created access reduces random signup noise and accidental data exposure.
Files and documents
Project files, proposals, contracts, payment proof, and handover documents should be handled as private project records.
  • Public forms should not receive passwords, API keys, or sensitive customer databases.
  • Uploaded files should be validated by type and size.
  • Private downloads should require authorization checks.
Admin-only information
Internal notes, lead qualification, provider responses, and operational context should remain separate from client-visible messages.
  • Admin notes are for MarGioM only.
  • Client-visible updates should be written clearly and intentionally.
  • Audit/activity logs help reconstruct what happened later.
Payment proof and gateways
Manual proof remains available, while Chapa or future gateways can verify payments server-side when configured.
  • MarGioM should not store full card, bank, or wallet credentials.
  • Manual proof is not final until admin verifies it.
  • Gateway callbacks must be verified before status becomes paid.
Production providers
MarGioM uses trusted infrastructure providers for hosting, storage, email, payments, and workflow data.
  • Vercel supports deployment and hosting.
  • Supabase supports database, auth readiness, and storage.
  • Resend supports transactional emails, and Chapa supports payment readiness.

Important client guidance

Do not upload secrets through public forms.

Public forms are useful for project requests, references, documents, screenshots, and business context. They should not be used for passwords, private keys, API secrets, payment card numbers, bank credentials, or confidential customer databases. Sensitive production access should be shared only through an approved secure handoff after the project is qualified.