SevaSetu follows least-privilege access, role-based authorization, secure secret management, audit logging and human oversight.

Never commit .env files, API keys, database credentials, JWT secrets, Supabase secret keys, access tokens or private citizen data.

AI recommendations must not automatically become final administrative decisions.