Overview of Trust and Security at Bukkinhomes

At Bukkinhomes (https://bukkinhomes.com.ng), protecting customer accounts, order information, payment details, and uploaded architectural files is fundamental to how the platform operates. Whether you are an end customer browsing product categories like Decorative Finishes, Stucco, India Finish, Rustic Brick, Flora Wall, or Emulsion paints, an agent managing referrals, or an artisan rendering wall finishing services, Bukkinhomes maintains strict technical and operational safeguards to keep your personal data and financial transactions safe.

Security is integrated directly into every layer of the website, from initial account registration and guest shopping to final payment handling and document delivery. By enforcing server-side verification protocols, strong data encryption, and multi-layered access controls, Bukkinhomes ensures that platform operations remain clear, reliable, and immune to unauthorized tampering.

This document details the security frameworks, privacy protections, user access rules, and payment safeguards enforced across the platform.

Core Security Architecture

Bukkinhomes relies on multi-tiered security protocols designed to protect users across all endpoints, payment gateways, and data storage systems.

Account Security

Account access controls are structured to ensure that only authorized users can view personal profiles, manage active orders, or access backend features.

Email Confirmation on Registration: Every newly created account requires verification through a unique confirmation link sent to the user's registered email address. Account features remain restricted until the email address is confirmed.
Password Encryption: User passwords are never stored in plain text. All passwords are processed using industry-standard, high-security hashing algorithms before being stored. Bukkinhomes staff and systems cannot view or retrieve plain text passwords.
Customer Session Management: Active customer login sessions automatically expire after 72 hours of inactivity. This standard protects account access if a session is left open on a shared or public mobile device or desktop computer.
Self-Service Password Resets: Users who forget their login details can initiate a secure password reset flow using their confirmed email address. Reset links are time-limited and single-use to prevent account hijacking.
Administrative Access Safeguards: Administrative accounts carry enhanced security controls. Admin logins require mandatory One-Time Password (OTP) verification sent via a secondary channel. Additionally, administrative sessions strictly expire after 3 hours of inactivity to prevent unauthorized access to sensitive operational tools.

Payment Security

Financial transactions on Bukkinhomes are designed to guarantee complete data isolation and protect against payment fraud or price alteration.

PCI-DSS Compliant Gateway: All card payments, bank transfers, and digital transactions are processed externally through Flutterwave, a fully PCI-DSS (Payment Card Industry Data Security Standard) compliant payment gateway.
Zero Storage of Card Data: Bukkinhomes never processes, views, or stores your payment card numbers, CVVs, expiry dates, or bank account PINs on its own servers. All financial credentials are handled exclusively by the payment gateway's encrypted payment interfaces.
Server-Side Verification: Payment outcomes are verified independently by Bukkinhomes servers directly contacting the gateway. Transaction success or failure is never decided by client-side browser actions, ensuring that web scripts cannot falsify payment confirmations.
Webhook Resilience: Payment updates are confirmed via secure backend webhooks sent from the gateway to Bukkinhomes. If a customer's browser window closes, crashes, or loses mobile network connection immediately after authorization, the payment webhook still registers the successful payment and updates the order status reliably.
Strict Amount Validation: Before an order is marked as paid, server-side algorithms validate the exact payment amount received against the actual price of the ordered items (such as paints, equipment, stone walls, or tools) stored in the database backend. This prevents malicious modification of order totals during checkout.

Data Protection and Storage

Customer profiles, delivery addresses, order histories, and uploaded project files are governed by strict data protection mechanisms.

Encrypted Storage: Primary platform data is hosted securely in Supabase databases, utilizing full encryption at rest. This ensures that physical storage media cannot be read if extracted.
Row-Level Security (RLS): The database enforces strict Row-Level Security rules. Users are strictly isolated to accessing only their own profile data, cart items, order records, and submitted service requests. One user cannot view, modify, or query another user's personal details under any circumstances.
Purpose-Driven Data Sharing: Customer details (such as recipient names, delivery addresses, and primary phone numbers) are shared solely with assigned logistics partners or verified service professionals strictly as needed to complete order fulfillment or service execution.
Data Monetization Prohibition: Bukkinhomes maintains an absolute policy against selling, renting, or leasing user data to third-party advertisers, market research firms, or data brokers.

Form Protection and Abuse Prevention

Public interaction touchpoints, including contact forms, 3D custom render request submission tools, and user applications, are shielded from malicious automation and automated spam bots.

Automated Spam Detection: Public forms utilize Google reCAPTCHA v3 protection to evaluate incoming interaction traffic and block automated bots without imposing intrusive user challenges.
Server-Side Input Validation: All data submitted through platform forms undergoes strict validation on the server side to filter out malformed entries, executable scripts, or malicious injection attempts.
Endpoint Rate Limiting: Sensitive operational endpoints (such as login forms, password reset requests, and custom rendering forms) are governed by automated rate limits to protect against brute-force attacks and service degradation.

Order Privacy and File Security

Bukkinhomes enforces privacy rules for all order tracking queries and media uploads, such as custom 3D wall renders and project specification documents.

Dual-Parameter Order Lookup: Accessing live order status and tracking information requires providing both the unique order reference code AND the associated customer email address. Knowing an order reference number alone is insufficient to view delivery or payment details.
Secure Guest Checkout Tokens: Orders placed via guest checkout generate secure, cryptographically random session tokens. Guest customers can check out without creating a full password-protected account while maintaining complete transaction privacy.
Signed Media URLs: Uploaded design files, wall measurements, and custom 3D render outputs are stored in private media buckets. Access is granted exclusively through short-lived signed URLs.
Token Expiration Rules: Once a signed media download link or temporary session token expires, it becomes completely invalid and cannot be reused, preventing unauthorized file scraping or permanent public link exposure.

How Security Protections Work in Practice

The following step-by-step process illustrates how Bukkinhomes enforces security protocols from the moment you interact with the platform through checkout and file handling:

Account Registration and Validation: When you sign up, your password is encrypted immediately before storage. An automated system sends a confirmation link to your provided email address. You must click this link to verify ownership of the address and activate full account privileges.
Session Activity Tracking: As long as you interact with your account, your session remains active. If you remain inactive for 72 hours on a customer account (or 3 hours on an administrator account), the system automatically invalidates your session token and requires re-authentication.
Initiating a Secured Checkout: When you add catalogue products (such as Accessories, Gravitas, Matt, Silk, or Tools) to your cart and proceed to checkout, Bukkinhomes compiles your order item values server-side and passes the encrypted total to Flutterwave.
Executing Gateway Payment: You enter your payment details directly into Flutterwave's PCI-DSS compliant payment interface. Bukkinhomes never records or intercepts your card details.
Server-to-Server Payment Confirmation: Upon authorization, Flutterwave sends a secure webhook payload directly to the Bukkinhomes backend. The server checks that the received funds match the order total down to the nearest Kobo. Once confirmed, the system updates your order status to approved.
Accessing Orders and Render Downloads: If you request a 3D custom render or track an order, the system validates your email address alongside the order reference. When downloading renders, the system generates a temporary signed URL that expires after a defined duration, revoking access automatically.

What Trust & Security Includes

Bukkinhomes incorporates comprehensive measures to ensure secure browsing, purchasing, and data management:

Account Safety: Mandatory email activation links, industry-standard password hashing, 72-hour session expiry for general users, mandatory OTP logins for administrators, and a 3-hour session expiry for admin privileges.
Payment Infrastructure: Integration with PCI-DSS compliant gateway (Flutterwave), total non-storage of financial credentials, server-side transaction audits, automated webhook confirmation routines, and anti-tampering amount verifications.
Data Rights and Privacy: Database-level Row-Level Security (RLS), full data encryption at rest in Supabase, strict data minimization during partner delivery handoffs, and complete access policies laid out in our Privacy Policy (/privacy) and Terms of Service (/terms).
File and Form Defenses: Automated bot filtering via reCAPTCHA v3, input sanitization on all forms, endpoint rate limiting against brute force attacks, dual-parameter order tracking, secure guest checkout tokens, and temporary signed download URLs for private media.

What We Do Not Do

To maintain complete transparency with our users, Bukkinhomes explicitly commits to the following operational boundaries:

We do NOT sell or monetize user data: Your personal information, contact records, and order history are never sold or rented to third parties.
We do NOT store payment card details: Your credit card numbers, debit card details, CVVs, and banking PINs are never stored on or transmitted through Bukkinhomes servers.
We do NOT store plain-text passwords: All passwords are irreversibly hashed before database storage.
We do NOT allow public access to private order records: Order statuses and architectural render uploads cannot be indexed by search engines or accessed without correct dual-parameter authorization.

Reporting Security Issues and Suspicious Activity

Bukkinhomes takes platform security and system vulnerability reports seriously. If you spot suspicious account activity, experience payment issues, or discover a potential technical vulnerability, please notify support immediately.