ADUQuoteDirect is designed to limit unnecessary exposure of homeowner information and to separate public project intake from private contractor access.
Security architecture
- Encrypted transport: production traffic is intended to be served only over HTTPS with HSTS.
- Restricted data access: homeowner records are accessed server-side with least-privilege application paths rather than exposed through public database policies.
- Application-level PII protection: sensitive contact fields can be encrypted with AES-256-GCM before database storage when the production encryption key is configured.
- Secret isolation: database service keys, payment secrets, messaging credentials, encryption keys, and webhook secrets belong in encrypted deployment environment variables and must never be committed to source control.
- Consent evidence: consent version, time, request metadata, and a privacy-preserving network identifier are stored separately for audit purposes.
- Rate limiting and bot controls: submission throttling and optional challenge verification reduce automated abuse.
- Payment separation: contractor payments are designed to use Stripe-hosted Checkout so full card numbers do not pass through our application.
- Private contractor access: homeowner contact information is intended to be visible to an authenticated contractor only after authorized lead access.
- Security headers: the web applications send HSTS, frame protection, MIME-sniffing protection, referrer controls, permissions policy, and Content Security Policy headers.
What we do not promise
No system is “unhackable,” and we do not claim perfect security. Security depends on correct production configuration, vendor settings, account security, access reviews, software updates, monitoring, and human behavior.
Operational security controls
Administrative access should use multi-factor authentication wherever available; privileged database and deployment access should be limited to necessary operators; payment webhooks must be signature-verified; backups and recovery procedures should be tested; dependencies and credentials should be reviewed regularly; and suspected incidents should follow a documented response process.
Responsible disclosure
If you believe you found a vulnerability, do not access data that is not yours, do not disrupt the Service, and do not publicly disclose the issue before we have a reasonable opportunity to investigate. Send a detailed report to security@aduquotedirect.com.