Data Security

Security responsibility

PT Aku Percaya Diri applies application safeguards and uses Cloudflare infrastructure services. No system is completely risk-free; this page does not guarantee that disruption or unauthorized access is impossible.

Passwords and sessions

Passwords are not stored as plain text: they are hashed using PBKDF2-SHA256 with a salt. Server-side session tokens are hashed. Session cookies use HttpOnly and SameSite, and Secure in the HTTPS production environment. Do not share passwords and sign out on shared devices.

Transport and access checks

The production service uses HTTPS. Requests that change data have their origin checked. Account access requires a valid session, and tax invoice documents require ownership or authorization checks. Catalog images are public media; do not upload private documents as catalog media.

Payments and documents

Payments are completed through Midtrans, not by sending card details through Gloopi service forms. Tax invoice PDFs are private objects and are not published through catalog media URLs. You are responsible for securely storing files you download.

Logs and retention

The application stores transaction status history, quotation conversations, and payment or shipping webhook records for processing and transaction checks. Retention follows service needs and legal obligations; this page makes no claim of independent audit, security certification, or automatic deletion schedules.

Reporting a security concern

If you suspect account misuse or discover a weakness, contact the official service details below. Describe the issue without sending passwords, session tokens, card details, or other customers’ data. Do not access or change data that does not belong to you.

Field-sales documents

Transfer proofs and delivery proofs are private storage objects, separate from public catalog images. Account invitations use a set-password link; do not forward that link to others.