How we protect your work

Encryption everywhere

Every connection to Estval is served over HTTPS/TLS, enforced with HSTS so browsers refuse to fall back to an unencrypted connection. Your plan sets are held in dedicated object storage, separate from the application database, and are never served from a public URL.

Your data is isolated to your account

Estval is multi-tenant, but your records aren't just filtered by the app. They're walled off at the database itself. Every table enforces row-level security so a query can only ever return the rows that belong to the signed-in account. Even if application code had a bug, the database won't hand one customer another customer's estimates.

Account protection

• Your first sign-in is always a one-time link sent to your email, which verifies the address before anything else happens. After that you can set a password for everyday sign-in, or keep using emailed links.
• Passwords are optional and stored only as salted scrypt hashes. We never see or store one in plain text, and an account without a password has nothing to steal.
• Sign-in links are single-use and expire after 15 minutes. A link that has been used, or has sat in an inbox too long, is inert.
• There is no self-serve sign-up. Accounts are created by our team after we've talked with you, so an attacker can't register their way in.
• Sign-in is protected by Cloudflare Turnstile and rate limiting to keep bots and password guessing out, and our staff and admin accounts additionally require a passkey second factor.
• Sessions are carried in secure, httpOnly cookies, not readable by page scripts. Signing in anywhere ends your session everywhere else.

Hardened by default

The app ships a strict, nonce-based Content Security Policy that blocks injected scripts, standard headers against clickjacking and MIME sniffing, and rate limiting on sensitive endpoints. Security updates are applied automatically, the database is reachable only from the application itself, and your plans sit in storage that is private by default: every link to one is signed and expires.

Payments

There's nothing to store: Estval doesn't take card details through the site. Estimates are quoted up front and invoiced directly, so your payment information never touches our servers.

Found something?

We take reports seriously and won't pursue good-faith researchers. If you believe you've found a vulnerability, email admin@estval.net with the details and steps to reproduce, and give us a reasonable window to fix it before disclosing publicly.