Security

Last updated 30 August 2026

How your documents are stored and how to report a vulnerability.

Before you publish this. These pages ship as a working draft. Replace the bracketed placeholders, then have somebody qualified read them against the law where you and your customers actually are. Nothing here is legal advice.

How this service protects the documents you put in it.

Document storage

Uploaded certificates and executed bonds are stored on a private disk that is not served over the web. There is no public URL for a document. Every download passes through the application, which checks that the requesting user belongs to the company that owns the record before anything is streamed.

Separation between companies

Where one installation serves several companies, every record carries the owning company and every query is scoped to it automatically. This is enforced in the data layer rather than in individual screens, and it is covered by automated tests.

Access control

Four roles — owner, administrator, estimator and viewer — decide what each person can see and change. Company settings, licensing and user management are restricted to owners and administrators.

Passwords and sessions

Passwords are hashed, never stored in readable form, and never sent by email. New users receive a link to set their own. Sessions expire, and signing out invalidates them.

Transport

Serve this application over HTTPS. When the configured address begins with https://, the application forces secure URLs so that password reset and download links cannot be downgraded.

Reporting a vulnerability

Write to [security email] with enough detail to reproduce the issue. We will acknowledge within [3 business days], keep you updated, and credit you if you would like. Please do not test against other customers' data.