Security at QuoteDash

Your account

• Passwords are never stored as you typed them. They are turned into a salted scrypt hash, a slow one-way scramble designed to resist guessing.
• After repeated wrong passwords, sign-in for that account is paused for a while.
• You can turn on two-factor sign-in with an authenticator app. The key behind it is stored encrypted, and your recovery codes are stored only as hashes, so we can't read them back to you.
• Signing in gives your browser a long random token. Only a hash of it is kept on our side, and it is sent in a cookie that scripts on the page can't read.
• Changing your password signs you out of your other browsers.

Your data stays yours

• Every page and every action is limited to the signed-in business. Another business's records are treated as not found.
• Your downloads (payments, invoices, jobs, customers and costs) only ever contain your own business's data.
• The admin view we use to run the service shows account-level facts such as sign-up date, plan status and how many texts were used. It doesn't show your quotes, invoices or customers.
• Your costs and profit are for your eyes only. They never appear on a customer's quote, invoice or PDF.

Your customers' links

Each quote, invoice and change order your customer receives has its own long, random address that can't be guessed. Those pages are kept out of search engines, and they don't pass their address on when someone follows a link away from the page.

Anyone who has the link can open it, so send it only to your customer.

Payments

Card and bank details are entered on Stripe's pages and never reach QuoteDash's servers. Payments go straight to your own Stripe account.

When Stripe tells us a payment happened, we check the message's signature before we act on it, so a forged message can't mark something paid.

How the site is protected

• The site is served over HTTPS only, and browsers are told to insist on it.
• Other websites can't display QuoteDash inside their own pages.
• Your camera and microphone are used only when you add photos or dictate notes, and only by QuoteDash itself.
• When something goes wrong, our error reports leave out cookies, form contents, names and the secret part of customer links.
• Spreadsheet downloads neutralize text that a spreadsheet could try to run as a formula.

Who handles your data

QuoteDash uses a hosting provider and a database provider to store data, Stripe for payments, Twilio for text messages and Resend for email. When you use the AI quote feature, the notes, photos and old quotes you choose to submit are sent to Anthropic to produce the draft. Nothing is sent to Anthropic unless you use that feature.

What you can do too

• Turn on two-factor sign-in, and keep the recovery codes somewhere safe.
• Use a password you don't use anywhere else.
• Don't share your login. Log out on a shared phone or computer.
• Send a quote link only to the customer it is for.