Secure Login and Customer Personal Data in Business Apps

As soon as your business app has a login, you're holding other people's personal data: names, emails, phone numbers, and transaction history. People hesitate to sign up if they doubt their data is safe. Your business, meanwhile, needs proof of consent and a way to delete data on request.

This article covers the basics in plain language, with examples from Numekara, the education business run by Lumekara's owner. The legal section is a general introduction only, not legal advice.

Choosing the right way to sign in

No single sign-in method suits every business. Numekara offers three options, each with its own strengths:

• Email OTP. The user enters an email and receives a one-time code. There's no password to remember, which cuts the risk of weak or reused passwords.
• Email and password. The most familiar method. It still needs sensible password rules and a safe reset process.
• Sign in with Google. Quick for anyone with a Google account, and you don't have to store their password.

With OTP login, one thing is often forgotten: limits. Without them, someone could request codes over and over to another person's inbox, or try to guess codes. Numekara applies OTP quotas to prevent this kind of abuse, and its problem-report form uses Cloudflare Turnstile as an anti-bot check.

Keeping sessions safe

After someone signs in, the app needs to “remember” them. How that session is stored matters a great deal for security. At Numekara, authentication uses Supabase Auth with a PKCE flow handled on the server, and sessions are kept in httpOnly cookies.

For a business owner, it means roughly this: the session token sits where scripts on the web page can't read it. If a malicious script ever slipped onto a page, it still couldn't easily grab a user's session. It's a simple layer of protection, but an important one. Also make sessions expire after a reasonable time, and make sure signing out really clears the session, especially for people using a shared computer.

Recording consent properly

When you collect data, say through a sign-up form or a free test, ask for consent clearly: what data you collect, what it's for, and whether the person agrees to be contacted for marketing. Avoid boxes that are ticked by default.

Consent also needs to be recorded well. At Numekara, consent records are kept permanently and can't be edited, so there's proof of when and for what someone gave permission. The system relies on those records too: Numekara's follow-up emails check a person's contact consent before anything is sent.

Giving users control of their account

Users should be able to delete their own account without emailing you and waiting for an admin. Numekara has a self-service account deletion page for exactly this. A feature like this shows you take customer data seriously, and it saves your team manual work.

When designing account deletion, also decide which data is truly removed and which must be kept, such as transaction records for bookkeeping. Discuss these rules with your legal or tax adviser.

Keep personal data out of logs and alerts

Data leaks don't only happen in the database. Personal data often ends up scattered in server logs, error messages, or alerts sent to a team chat. A few habits help:

• Filter personal data from logs. At Numekara, logs filter out personal data before it's written.
• Use IDs, not the data itself. Numekara's Telegram and email alerts are built from event IDs, so personal data stays out of the logs.
• Limit admin access. Not everyone on the team needs to see every customer record.
• Mask data in demos. Don't record or share admin screens that show real customer data.

A general look at Indonesia's PDP law

Indonesia has UU No. 27 Tahun 2022 tentang Pelindungan Data Pribadi, the Personal Data Protection Law. Broadly, it governs how personal data is collected, processed, and protected. It recognises the rights of the people the data is about, such as the right to access, correct, and request deletion of their data, and it places duties on whoever manages the data to keep it secure.

The technical features above can help you meet those duties, but they don't make your business compliant on their own. Compliance also covers your privacy policy, internal procedures, and agreements with third parties. To be sure which obligations apply to you, consult a legal professional who understands personal data protection.

Next steps

Review your current app or website: how users sign in, where sessions are stored, whether consent is recorded, and whether users can delete their accounts. Fix the riskiest gaps first, then complete your privacy policy with a legal professional.