Trust & Security

Accounts are protected by email/password sign-in. Passwords are never stored in the application database — they are handled by our managed authentication provider.

Sessions use short-lived bearer tokens that are validated on the server for every request to a protected endpoint.

The app is served exclusively over HTTPS. All traffic between your browser, our servers, and the database is encrypted using TLS.

Customer data (estimates, clients, photos, invitations) is scoped to the organization that created it. Database row-level security policies enforce that users can only read or modify rows belonging to an organization they are a member of.

Privileged server operations run server-side only; service credentials are never shipped to the browser.

Estimates can be shared with clients via a unique signing link. The public signing endpoint only accepts client signatures — provider (contractor) signatures can only be applied from inside an authenticated account that owns the estimate.

Invitation tokens are stored as SHA-256 hashes, not in plaintext, so a database snapshot cannot be used to impersonate a pending invitee.

Uploaded logos and project photos are kept in private storage buckets. The app generates short-lived signed URLs on demand; files are not publicly listable.

Subscription billing is processed by Paddle. ConstructEst Pro never receives or stores full card numbers; we only retain the subscription status and identifiers needed to manage your plan.

If you believe you've found a vulnerability, please email security@constructestpro.com. Please include steps to reproduce and avoid testing against other users' data.