How we protect your work

Encryption everywhere

Every connection to Estval is served over HTTPS/TLS, enforced with HSTS so browsers refuse to fall back to an unencrypted connection. Your plan sets are held in dedicated object storage, separate from the application database, and are never served from a public URL.

Your data is isolated to your account

Estval is multi-tenant, but your records aren't just filtered by the app. They're walled off at the database itself. Every table enforces row-level security so a query can only ever return the rows that belong to the signed-in account. Even if application code had a bug, the database won't hand one customer another customer's estimates.

Account protection

• There are no passwords. You sign in with a one-time link sent to your email, so there's nothing to steal, guess, or reuse from another site.
• Sign-in links are single-use and expire after 15 minutes. A link that has been used, or has sat in an inbox too long, is inert.
• There is no self-serve sign-up. Accounts are created by our team for customers we're working with, so an attacker can't register their way in.
• Sign-in is protected by Cloudflare Turnstile to keep bots out, and our staff and admin accounts additionally require a passkey second factor.
• Sessions are carried in secure, httpOnly cookies, not readable by page scripts.

Hardened by default

The app ships a strict, nonce-based Content Security Policy that blocks injected scripts, standard headers against clickjacking and MIME sniffing, and rate limiting on sensitive endpoints. Security updates are applied automatically, the database is reachable only from the application itself, and your plans sit in storage that is private by default: every link to one is signed and expires.

Payments

There's nothing to store: Estval doesn't take card details through the site. Estimates are quoted up front and invoiced directly, so your payment information never touches our servers.

Found something?

We take reports seriously and won't pursue good-faith researchers. If you believe you've found a vulnerability, email admin@estval.net with the details and steps to reproduce, and give us a reasonable window to fix it before disclosing publicly.