Built to protect the information your business relies on.
Security is considered across account access, data handling, infrastructure and product development.
Secure account access
Passwords are hashed, never stored in plain text, and sessions are handled through our authentication framework's secure defaults.
Access controls
Every organisation's data is isolated at the database-query level — one account can't reach another organisation's records, enforced in code and covered by automated tests.
Data protection
Traffic to QuoteASAP is encrypted in transit (HTTPS), and our database provider encrypts data at rest.
Infrastructure
QuoteASAP runs on established managed platforms (Vercel for hosting, Neon for the database) rather than self-managed servers.
Application security
Every change is typechecked, linted, tested and built in an automated pipeline before it can reach production.
Service monitoring
Key account and organisation actions are recorded in an audit trail, and the application writes structured logs for errors and diagnostics.
Backups and recovery
QuoteASAP is developing formal, documented backup and recovery procedures beyond what our managed database provider handles by default.
Responsible vulnerability reporting
If you find a security issue, we want to hear about it privately — see “Report a security concern” below.
Account security
Passwords are hashed using bcrypt before they're stored — QuoteASAP never stores or has access to your plain-text password. Signing in issues a session managed through our authentication framework's standard secure session handling.
Multi-factor authentication is not yet available. We're considering it as a future addition rather than describing it as available today.
Data handling
QuoteASAP stores the information needed to run your account — your business details, organisation and membership records, and the details of the customers and quotes you create in the product. This is required to provide the service itself, not collected for any other purpose.
You remain responsible for the accuracy of the information you and your customers enter into QuoteASAP. Access to your organisation's data is limited to members of that organisation — enforced at the database-query level, not just in the interface.
Data is transmitted over encrypted (HTTPS) connections and stored on Neon, our managed Postgres provider. If you close your account or ask us to delete your data, we handle that request in line with our Privacy Policy.
Infrastructure and development
QuoteASAP is hosted on Vercel, with Neon providing the managed Postgres database. All traffic is served over HTTPS. Production, preview and development environments are kept separate, each with their own configuration and credentials.
Every change to the codebase is automatically typechecked, linted, tested and built before it can be deployed — the same pipeline runs on every proposed change, not just occasionally.
QuoteASAP is developing more formal processes for monitoring, incident response and backup verification as the product and business mature — we'd rather say that plainly than describe processes that don't exist yet.
Compliance and roadmap
| Area | Status |
|---|---|
| Privacy Policy, Terms of Service, Cookie Policy | Implemented |
| Tenant data isolation, with automated tests | Implemented |
| Automated typecheck/lint/test/build on every change | Implemented |
| UK GDPR-aligned privacy practices | Implemented |
| Multi-factor authentication | Planned |
| Formal incident-response and backup-verification procedures | In progress |
| Cyber Essentials, ISO 27001, SOC 2 or similar certification | Not currently held |
Report a security concern
If you believe you've found a security issue affecting QuoteASAP, please report it privately so it can be investigated before any public disclosure. Email support@quoteasap.co.uk with the details.
Security FAQ
Still have a security question?
Get in touch and we'll make sure it reaches the right place.