Security Overview

Access and tenant controls

• Clerk-managed authentication and server-side user resolution.
• Tenant-qualified core records and role-based capabilities for contractor workspaces.
• Public proposal access uses unguessable tokens; signing is rate limited and records acceptance evidence.
• Platform administration is restricted to an explicit operator allowlist.

Application safeguards

• Central browser security headers, including content security policy, frame protection, HSTS, referrer policy, and permissions policy.
• Route-specific rate limits for public submissions and sensitive authenticated uploads and exports.
• Tenant-qualified file paths and restricted raster-image upload types for current logo and job-photo flows.
• Audit events for trust-critical actions and idempotency controls for Stripe webhooks.

Data and provider safeguards

• Managed PostgreSQL hosting, Vercel application hosting and Blob storage, and provider-managed encryption in transit and at rest where offered by those providers.
• Production credentials are intended to be stored in managed environment secret stores rather than source code.
• Stripe-hosted collection is used so Trough is not designed to receive raw card numbers.
• Tenant export and logical backup tooling exist, but provider-level recovery configuration and a full restore drill remain launch-readiness work until documented as complete.

Proposal evidence

• Signer name, affirmative acceptance, timestamp, IP address, user-agent, acceptance language, proposal snapshot, and SHA-256 snapshot hash.
• Estimate changes are restricted after a proposal is shared or signed.
• Signature evidence supports auditability but does not replace jurisdiction-specific contractor terms and consumer notices.

Customer responsibilities

• Use unique accounts, protect devices and credentials, remove departed staff, and assign the least privilege needed.
• Verify recipients before sending proposal links, exports, photos, or customer communications.
• Do not store prohibited sensitive data or secrets in notes, photos, imports, or support requests.
• Keep independent copies of records required for legal, tax, payroll, warranty, and contracting obligations.

Reporting security concerns

Report a suspected vulnerability, unauthorized account access, exposed proposal link, or data incident to support@trough.app. Include a concise description and affected URL or workspace, but do not include passwords, tokens, card numbers, or unnecessary personal data. Trough will investigate, contain, document, and provide legally required notices based on the facts and applicable agreements.