Security

What protects your data, and what does not yet.

What's in place

• Passwords are hashed with scrypt, a memory-hard algorithm, using a random salt per account and a constant-time comparison. We cannot read your password and neither could anyone who obtained the database.
• Sessions are signed, HTTP-only, same-site cookies. They cannot be read by JavaScript and cannot be forged without our signing key.
• Separation between businesses is enforced on every query, from your session — never from anything in the URL. There is no page that accepts a business identifier as a parameter, which is how this normally goes wrong.
• Quote links sent to your customers are cryptographically signed and expire. They cannot be guessed or altered.
• Incoming webhooks from WhatsApp and Stripe are signature-verified, so nobody can fake a message or a payment.
• Sign-in and password reset are rate limited, and reset codes are hashed and limited to five attempts.
• Card data never reaches our servers. Stripe collects it directly.
• Everything is served over HTTPS.

What isn't, yet

We would rather tell you than let you assume.

• No two-factor authentication on dashboard sign-in.
• No independent security audit or certification (no SOC 2, no ISO 27001).
• No customer-facing audit log of changes made inside your own account.

These are on the list. If any of them is a condition of you signing up, tell us — it moves things up the list.

Reporting a vulnerability

Email info@quotebot.online. Please give us a reasonable chance to fix it before publishing. We will not take action against anyone who reports in good faith and does not access or alter other people's data.

If something goes wrong

If a breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Last updated 7 August 2026.