Trust Center
This page reflects our actual production security and privacy controls — not marketing claims we do not implement. Last updated: July 8, 2026.
Security Practices
HTTPS with HSTS, revocable server-side admin sessions (8-hour expiry), mandatory TOTP two-factor authentication for admin login, signed expiring invoice access links (30 days), Redis-backed rate limiting for login, quote and invoice endpoints, origin checks (CSRF protection) on state-changing API requests, honeypot spam protection on the quote form, and a nonce-based Content Security Policy in production.
Data Protection
We collect only information needed to review quote requests, deliver services, and communicate about projects. Quote submissions record separate consent for Terms, Privacy, and contact with timestamps and policy version. Client data is stored in a PostgreSQL database that is not exposed to the internet and is not sold to third parties.
Client Portal Authentication
Clients sign in with their quote reference number and email address. After successful verification, a secure HttpOnly session cookie is issued. Email addresses are not passed in URLs. Sessions expire after 7 days or on sign-out.
Invoice Access
Invoices are not accessible by invoice number alone. Each invoice uses a cryptographically signed, expiring access link. Invalid links return 404; expired links show a secure error without exposing data.
Infrastructure
The application runs behind an HTTPS reverse proxy. The database and Redis accept connections only from the application server and are not exposed to the internet; the application connects to the database with a dedicated account. Sessions are stored in PostgreSQL and Redis is used for rate limiting. When email delivery is enabled, it is sent through Resend.
Prohibited Projects
We do not provide illegal or harmful software, phishing or malware systems, spam tools, fake document services, unauthorized data collection, financial scam systems, or similar prohibited work. See our Acceptable Use Policy.
Contact for Security Questions
Email security@polktab.online or use our contact form.