How we protect your work

Encryption everywhere

Every connection to Estval is served over HTTPS/TLS, enforced with HSTS so browsers refuse to fall back to an unencrypted connection. Your data is encrypted in transit, and encrypted at rest in our database.

Your data is isolated to your account

Estval is multi-tenant, but your records aren't just filtered by the app — they're walled off at the database itself. Every table enforces row-level security so a query can only ever return the rows that belong to the signed-in account. Even if application code had a bug, the database won't hand one customer another customer's estimates.

Account protection

• Two-factor authentication is required on every account — a password alone is never enough to get in.
• Sign-in and sign-up are protected by Cloudflare Turnstile to keep bots and credential-stuffing out.
• Passwords are hashed by our auth provider; we never store or see them in plain text.
• Sessions are carried in secure, httpOnly cookies, not readable by page scripts.

Hardened by default

The app ships a strict, nonce-based Content Security Policy that blocks injected scripts, standard headers against clickjacking and MIME sniffing, and rate limiting on sensitive endpoints. We run on managed, SOC 2–compliant infrastructure (Supabase and Vercel) so patching and physical security are handled by providers that do it full-time.

Payments

There's nothing to store: Estval doesn't take card details through the site. Estimates are quoted up front and invoiced directly, so your payment information never touches our servers.

Found something?

We take reports seriously and won't pursue good-faith researchers. If you believe you've found a vulnerability, email admin@estval.net with the details and steps to reproduce, and give us a reasonable window to fix it before disclosing publicly.