Security

What we actually do, described without theatre

Security claims are easy to write and hard to verify. This page lists the controls QuotePilot implements, and is honest about what has not been independently audited.

Tenant isolation in the database

Every tenant-owned record carries a company identifier.
Row level security is enabled on every exposed tenant table.
Policies check membership and role using a fixed, empty search path so a caller cannot redirect lookups.
Composite foreign keys make cross-company references impossible, not merely discouraged.
Anonymous database access is revoked rather than restricted.
Service credentials never reach the browser or a client bundle.

Who can change a price

Calculated totals are produced by database logic and cannot be written from a browser.
Discounts, tax and margin rules require an owner or admin role.
Locking a quote writes an immutable version with the authenticated actor and a timestamp.
Editing a locked quote creates a new version instead of altering history.
A company must always retain at least one owner, and admins cannot assign or remove owners.

Untrusted client content

Briefs and uploads are treated as data, never as instructions.
Content is wrapped in explicit delimiters and the model is instructed that embedded instructions cannot change its rules or reach tools.
Recognised injection patterns are recorded against the brief so a reviewer can see them.
Requests are rate limited and provider calls have timeouts, bounded retries and a circuit breaker.

Payments and integrations

Stripe webhooks are verified by signature before any event field is trusted.
Webhook events are de-duplicated by event id so a repeated delivery cannot double-apply.
Subscription state is written only by verified server-side logic.
Third-party API keys are read from server-side environment variables only.

Application hardening

Strict security headers including HSTS, frame denial and a restrictive referrer policy.
Server-side validation of every request body against a runtime schema.
Structured logs with a correlation id, and automatic redaction of secret-shaped fields.
Dependencies pinned through a lockfile and reviewed before upgrades.

What we are not claiming

QuotePilot has not completed an independent security certification such as SOC 2 or ISO 27001.
We do not claim to be immune to every attack. We aim to reduce the impact of the ones we can foresee.
We do not store card details. Payment details are handled by our payment processor.

Backups and recovery

Data is hosted on managed infrastructure with automated backups and point-in-time recovery provided by the platform. Restores are performed by the platform operator. If a restore is ever required, affected workspaces are told what happened and what was recovered.

Reporting a vulnerability

Email hello@myevent-labs.io with enough detail to reproduce the issue. Please do not test against another customer's workspace, and give us a reasonable opportunity to respond before public disclosure. We will confirm receipt and tell you what we intend to do.