Security
Security & data practices
What we actually do, stated specifically — including the things we don't have yet. The same honesty rules that govern our data (sources shown, estimates marked) govern this page.
Infrastructure
- Hosted on Vercel and Supabase
- The application runs on Vercel; the database is Supabase-managed Postgres. Both providers maintain their own extensive security and compliance programs, and we inherit their physical, network, and platform controls.
- Encryption in transit, everywhere
- All traffic — browser to app, and app to database — runs over TLS. Database connections are certificate-verified; plaintext connections are rejected at the server.
- Encryption at rest
- Database storage and backups are encrypted at rest by Supabase. Third-party OAuth tokens we hold (e.g., a customer’s HubSpot connection) are additionally encrypted at the application layer before storage.
- Backups & recovery
- Managed daily backups with point-in-time recovery through Supabase.
Application
- Row-level isolation
- Customer data (saved searches, tracked accounts, pipeline, notes) is protected by Postgres row-level security with a default-deny policy — one customer’s rows are not queryable as another, at the database layer, independent of application code.
- Payments never touch our servers
- Billing is handled entirely by Stripe. We never see, store, or transmit card numbers; our database holds only Stripe’s opaque customer and subscription identifiers.
- Least-privilege sessions
- Authentication is Supabase Auth (magic link or password). Sessions are cookie-based and validated server-side on every request; API keys for the developer API are scoped, hashed at rest, and revocable.
- Export hygiene
- CSV exports are sanitized against spreadsheet formula injection — a cell can’t execute when opened in Excel.
Data content & sourcing
- Public records only
- Everything in the product derives from government records: building permits published by cities and counties, the Arizona ROC contractor roster, county assessor rolls, recorded sales, and ADWR water determinations. Every record links to its source, and estimates are always marked (~ EST).
- Property-owner data is gated
- Owner names and mailing addresses from assessor records display in-product for research, with bulk redistribution disabled and a contractual ban on using them for mass solicitation. We deliberately do not sell homeowner mail-merge files — see our Data Sourcing page for the full policy.
- No data resale
- We don’t license, resell, or share customer data or compiled datasets with third parties. The product is the product.
Honest limits
- No SOC 2 (yet)
- We’re a founder-run company and haven’t undergone a SOC 2 audit. If your procurement process requires one, we’d rather tell you now than imply otherwise — and if you need specific security details for a review, ask and we’ll answer directly.
- Report a vulnerability
- Found something? Email security@plumbintel.com. We read every report, respond quickly, and will credit you if you’d like.
Related: Data Sourcing · Privacy · Terms