Security & your data
The short version
Your projects, price book and proposals are yours. They're encrypted in transit, stored on Cloudflare's global infrastructure, we never see or store your card details, there's no password to steal, and you can export or permanently delete everything yourself — no email required, no questions asked.
How your account is protected
- No passwords, ever. Sign-in works by a one-time email link that expires in 15 minutes. There is no password database to breach — the most common way small-business accounts get compromised simply doesn't exist here.
- Sign-in tokens are hashed at rest. Even the one-time links and session tokens are stored only as cryptographic hashes — a database leak would not yield usable credentials.
- Rate-limited by address and network, so automated attacks on the sign-in system are throttled at the edge.
How your payment is protected
- We never see your card. Payments are handled entirely by Stripe (the payment processor used by Amazon and Shopify) on Stripe's own pages. Card numbers never touch our servers.
- Billing events are cryptographically verified between Stripe and us, so your subscription state can't be spoofed.
- Cancel anytime from your account panel — it's self-serve, no email needed.
How your data is protected
- Encrypted in transit — TLS everywhere, with HSTS enforced so connections can't be downgraded.
- Isolated per account — every read and write is scoped to your account at the database layer.
- Hosted on Cloudflare — the same network that shields a large share of the web, with DDoS protection built in.
- Hardened against injected content — proposal pages served to your clients run under a strict Content-Security-Policy that blocks any injected script.
Your data is yours — provably
- One-click export: download everything — account, projects, proposals — as a single file from your account panel, anytime.
- One-click delete: permanently erase your account and all data yourself, instantly. Any active subscription is cancelled in the same step.
- No lock-in: your price book imports and exports as CSV; projects export as files you keep.
What we collect (and don't)
We collect what the product needs to work: your email, your projects, and billing status. We don't run ads, we don't sell data, and we don't use tracking beyond what's needed to operate the service. The full detail lives in the Privacy Policy, including our sub-processors (Cloudflare, Stripe, Resend, Anthropic for the optional AI estimator).
Questions or a security concern?
Email [email protected]. Security reports are read first and answered fast — if you find something, we genuinely want to know.