Security

What we do not claim

Starting here, because it is the part most security pages leave out.

• We are not SOC 2 or ISO 27001 certified. Those audits cost more than this product currently makes, and claiming them would be a lie.
• We have not had a third-party penetration test. We will, and we will say so here when we have.
• We are a small company. Two people, in the UK. If that is a problem for your procurement process, it is better that you know now.

What follows is what is actually true, and each of it is a decision somebody made rather than a default.

Your quote links

• Each link carries 32 bytes from a cryptographic random source, which is not guessable by brute force.
• We store only a sha256 hash of it. A copy of our database does not yield a single working link. It also means we cannot recover a link for you, which is the same property viewed from the other side.
• Links expire, can be revoked, and their use is counted.
• Rate limits apply per address and per link, so somebody walking the link space is stopped rather than merely unlikely to succeed.

Never in a search engine

A client’s quote appearing in a search result would be a reportable data breach, so it is not left to one control. Every quote page carries a noindex tag, an X-Robots-Tag response header, and a robots.txt exclusion, and an automated test asserts all three on every single deploy. If any one of them stopped being true, the build would fail before it reached you.

Your bank details

If you choose to show bank details to your client, they get a second layer of encryption at the application level, with a key held separately from the database. A copy of the database on its own does not expose them.

If that key is ever unavailable, we refuse to store the details at all rather than writing them unencrypted. Failing closed is the point.

Payments

We have never handled a card number and we do not intend to. Card payments, once switched on, happen entirely on Stripe’s own pages, and the money goes directly to your Stripe account rather than through us. We are not in the payment path.

Your client’s privacy

• We record the first time a quote is opened and nothing after. Not every visit, not their location, not what else they looked at.
• Their IP address is hashed with a salt unique to that document. Enough to spot a machine opening a thousand quotes; not enough to identify a person or to correlate them across quotes.
• They are never asked to create an account or verify an email.

Accounts

• There are no passwords. You sign in with a link, valid for 15 minutes and usable once. There is nothing to reuse, leak or guess.
• Sign-in does not reveal whether an address has an account, so it cannot be used to find out which businesses use QuotePack.
• Sessions are httpOnly and SameSite, and can be ended at any time.

The figures

Every total, tax figure and deposit is computed on our server, in whole pence, by code with 100% branch coverage across every combination of VAT rate, registration status and inclusive or exclusive pricing. Nothing is calculated in your browser, so nothing a visitor edits in their developer tools changes what a quote says.

AI is used to read a pasted enquiry and to draft prose. It never produces a number. The response schema has no numeric money field at all, and a validation pass strips any currency pattern that appears in generated text.

Infrastructure

• Hosted on Vercel in London; database on Supabase in the EU (London)
• HTTPS everywhere, with HSTS
• Encrypted at rest
• Daily backups, held by Supabase. We have not yet rehearsed a restore, so we do not claim a tested recovery time. That rehearsal is scheduled, and this line will say when it has happened and what it showed
• No secrets in the codebase; environment variables scoped per environment
• Dependency vulnerability and secret scanning on every change

Telling us about a problem

If you think you have found a security issue, email help@quotepack.co.uk with SECURITY in the subject. We will acknowledge within one working day.

Please do not test against other people’s quotes, and please give us a reasonable chance to fix it before telling anyone else. We will not pursue anyone who reports a genuine issue in good faith. We do not currently pay a bounty, and we will say so here if that changes.

More

Our privacy policy covers what we hold and for how long.