How your customer list is protected.

Accounts are separated

Every quote, contact and message belongs to one business. The database enforces that separation on every read and write, and the server checks who you are on every request rather than trusting the browser.

Sign-in

Sign-in runs on managed authentication infrastructure. Passwords are stored only as salted hashes, never in readable form, and we never see them. Email verification and password reset are built in, and sessions expire.

Encryption

All traffic is encrypted in transit. Data at rest is encrypted by the hosting infrastructure.

Secrets

Payment and messaging credentials live in server-side secret storage. They are never included in anything sent to your browser.

Audit logging

Sensitive administrative actions — plan changes, account suspension, credits, data deletion — are recorded with who did it and when, and the risky ones require an explicit confirmation step.

Backups

The database is backed up by the hosting platform on a rolling schedule. Our internal recovery checklist covers who restores, from which snapshot, and how we verify the restore before letting customers back in.

Payment details

We never see or store card numbers. Card entry, storage and charging happen entirely inside the payment provider.

Monitoring

Application errors, failed background jobs, message delivery failures and webhook problems are logged and alerted on. A follow-up that fails to send is visible and retried rather than silently dropped.

Reporting a problem

If you believe you have found a security issue, we want to hear about it before anyone else does. A published security contact address is an outstanding owner action and will appear here once it exists.