Security
What we do to protect company and homeowner data, described without hype.
Company separation
Every company's data is scoped to that company, and technicians cannot see costs, markups or margins.
Accounts
Passwords are hashed. Sessions use random tokens stored as hashes, in httpOnly cookies. Sign-in, sign-up, password reset and public forms are rate limited.
Public links
Proposal links use long random tokens, are not indexed by search engines, and expire according to company settings.
Providers
We rely on Replit, Resend, Paddle and Cloudflare for hosting, email, billing and network services.
Your data
Owners can export company data and delete their account.
Reporting an issue
Email support@tiermenu.com with details of any security concern.
Questions: support@tiermenu.com