Proof deserves protection.

Workspace isolation

Every customer record carries a workspace identifier resolved from the authenticated user’s server-side membership. Client-supplied tenant identifiers are never treated as authority.

Private files

Job photos and generated reports use private object storage. Retrieval requires an authenticated workspace membership check. Uploads use size and type limits, content-signature validation, server-side image reprocessing, per-job limits, and workspace storage quotas.

Payments

ClientProof does not handle card numbers. Stripe-hosted Checkout and the Stripe customer portal handle payment details. Subscription access changes only after a correctly signed, time-limited webhook is processed, with event IDs stored to prevent duplicate processing.

Operational controls

• Parameterized database queries and server-side authorization.
• Private no-store responses for account and billing data.
• Versioned report snapshots and provider delivery records.
• Dependency audits and automated authentication/tenant tests.
• No claim of email delivery until the provider accepts the message.

Responsible disclosure

A dedicated security contact and response SLA will be published when the operating domain is connected. Do not include sensitive customer information in an initial vulnerability report.