SECURITY OVERVIEW

Security built around business boundaries

Updated 16 September 2026

This page describes controls implemented in the current production service. It is not a claim of certification or a guarantee that every risk can be eliminated.

Identity and access

• Server-side sessions use secure, HTTP-only cookies and durable user identities.
• Workspace access is resolved from server-side business membership on every protected request.
• Administrative access is separately allowlisted and role checked.
• Production authentication uses OpenID Connect through Auth0, with verified-email and password-recovery flows. Administrative accounts require multi-factor authentication.

Tenant separation and data controls

• Business records, saved state, assets, backups, analytics and feedback are scoped to the authenticated business ID.
• Owners can export structured workspace data, create restore points and initiate permanent account deletion.
• Uploads are type and size constrained. Sensitive workspace data is not placed in client-visible credentials.

Application and operational safeguards

• Origin checks protect state-changing forms and APIs; billing webhooks require provider signatures.
• Production builds run calculation, authentication, access-control, tenant-boundary, legal, billing, mobile and rendered-output tests.
• Production release gates require legal, hosting, identity, domain and payment prerequisites before public signup or billing can be enabled.
• Security incidents follow the written triage, containment, evidence, notification and recovery runbook.

Shared responsibility

Customers must control authorised users, protect devices and credentials, avoid unnecessary special-category data, verify estimates before sending them, and promptly report suspected compromise to security@quercusquote.app.