How we keep your business data safe

Infrastructure

JobPricer runs on Google Cloud (Firebase). Google handles the physical security, network protection, and hardware redundancy at the data-center level. Their security posture is certified to SOC 2, ISO 27001/27017/27018, HIPAA, and others.

Encryption

• In transit: All traffic to and from JobPricer uses HTTPS (TLS 1.2+). The site enforces HSTS so browsers refuse downgrades to HTTP.
• At rest: Your business data is encrypted at rest by Firebase using AES-256.
• Passwords: Hashed and salted using bcrypt — we cannot see your actual password.

Per-account isolation

Every JobPricer account has its own isolated data namespace. Firebase Security Rules enforce that no account can read or write another account data — even if there is a bug elsewhere in the app, the database itself blocks cross-account access.

Authentication

We support email + password sign-in, with the option to sign in with Google. Forgotten passwords are reset via a one-time link emailed to the address on file.

Payments (Stripe Connect)

JobPricer is a Stripe Connect platform. Card payments — both for your JobPricer subscription and for your customer deposits/invoices — are processed by Stripe, which is PCI-DSS Level 1 certified (the highest tier). Card numbers never touch JobPricer servers. When you accept customer payments through the app, you connect your own Stripe account and money flows directly to your bank — with a 0% platform fee on Pro and Business plans (2% on the Free tier). See Terms §4 for the full platform relationship.

Email & SMS providers

Transactional email (account confirmations, quote notifications, receipts) is sent via Resend. Customer SMS (quote follow-ups, appointment reminders) is sent via our SMS provider (QUO / OpenPhone). Both providers process only the message content and destination address needed to deliver.

AI processing

AI quote drafts are generated by third-party AI providers (e.g., OpenAI / Anthropic). Under our agreements:

• Your prompts and your AI outputs are not used to train the AI models.
• Data is sent over encrypted connections.
• AI usage is rate-limited per account so a leaked API key cannot drain your tokens.

Backups

Firebase automatically backs up your account data on a rolling schedule, with point-in-time recovery available for our team in the event of an incident.

Incident response

If a security incident affecting customer data is detected, we will:

1. Contain and investigate within 24 hours.
2. Notify affected accounts within 72 hours of confirmation.
3. Post a public summary on our updates page.
4. Implement and document corrective measures.

Reporting a vulnerability

We welcome responsible disclosure. Email hello@jobpricer.app with the subject line Security disclosure. We will respond within 3 business days, confirm or fix within 30 days where reasonable, and credit you (with your consent).

What we are working on

• SSO — Google sign-in is live; Apple sign-in is on the roadmap.
• 2FA — Two-factor authentication for paid plans is on the roadmap.
• SOC 2 — We are early-stage and not currently SOC 2 certified. We will pursue it when our customer base and team size warrant the audit cost. (Many of our peers misrepresent this; we would rather be honest.)

Contact

Security questions or concerns: hello@jobpricer.app.