Security

Version 1.1 · Last updated TBD — launch date

PriceMyWash is built and run by one person. We don't have a security team or a SOC 2 report, so this page explains plainly what we do to protect your data, and what we don't do.

Contents

1. Where your data lives
2. Encryption
3. Access
4. How we build and run the product
5. Backups and deletion
6. Product-specific measures
7. What we don't have (yet)
8. Reporting a vulnerability

1. Where your data lives

The application and database run on servers rented from Hetzner in Germany (EU), in ISO 27001-certified data centres. Cloudflare sits in front of the site for DNS, TLS and protection against attacks. Other services that receive data are listed on the Subprocessors page.

2. Encryption

• All traffic uses HTTPS (TLS 1.2 or newer), with HSTS.
• Disks and database backups are encrypted.
• API keys, access tokens and other credentials for systems you connect are encrypted again inside the database (libsodium sealed boxes) with a key that is stored separately from the database. They are decrypted only in memory when a job needs them, never shown back in full, and never written to logs.

3. Access

• Only the founder can access production systems, using SSH keys and two-factor authentication on every admin account (hosting, DNS, source code, email, payments).
• Automated deployments use a separate key with limited rights.
• We look at your data only when needed to support you, fix a problem you reported, or investigate abuse or a security issue.
• Sign-in uses email and password or Google. Passwords are stored only as salted, slow hashes (never in plain text), and we never see them.

4. How we build and run the product

• Every database query is scoped to your organisation, and automated tests check that one customer can't see another's data.
• Dependencies are kept up to date and scanned for known vulnerabilities.
• Staging and production are separate; staging never contains production personal data.
• Errors and logs are kept on our own server for 30 days, and we scrub personal data (request bodies, tokens) from error reports.
• Uptime is monitored every minute and alerts go to the founder.
• We follow a written incident procedure. If a breach affects your personal data, we will notify you within 48 hours of becoming aware of it (see the DPA).

5. Backups and deletion

• The database is backed up nightly and backups are kept for 60 days. We test restores regularly.
• When you delete data or close your account, it is deleted from the live system within 30 days and from backups as they expire.

6. Product-specific measures

The widget

• The widget loads from a separate address (w. subdomain) that sets no cookies and holds no secrets; our server strips any cookie headers on it as a second guard.
• It runs in an isolated frame: your website can't read what homeowners type into the widget, and the widget can't read your website.
• The loader script on your page only reports page views and the number of form submissions (never form contents), and it is small and doesn't change your page.
• The quote form is protected by Cloudflare Turnstile and rate limits, so bots can't flood you with fake leads. We store only a hashed IP address for this.

Leads

• Leads are visible only to members of your PriceMyWash account and are sent only to the verified email addresses you choose.
• You can delete any lead at once, export all leads as CSV, and set how long leads are kept (default 24 months).
• Error reports scrub request bodies, so homeowners' details don't end up in our logs.
• Lead alert emails contain the homeowner's details. Protect the mailbox that receives them (use two-factor authentication).

Demo pages

Demo pages are hidden from search engines, say they were made by PriceMyWash and that the business is not affiliated, and can't collect real leads. Claiming a demo only copies its settings into the claimer's own account.

7. What we don't have (yet)

• No SOC 2 or ISO 27001 certification of our own (our hosting provider is certified).
• No 24/7 on-call team: alerts reach one person, so outside business hours in Central/Eastern Europe responses can be slower.
• No bug bounty with payouts, but we are grateful for reports (see below) and will credit you if you like.

If your organisation needs a security questionnaire answered, email support@pricemywash.com.

8. Reporting a vulnerability

Email security@pricemywash.com with details and steps to reproduce. Please give us reasonable time to fix the issue before disclosing it, don't access or change other people's data, and don't run tests that degrade the service (no load or denial-of-service testing). We won't take legal action against good-faith research that follows these rules. We aim to acknowledge reports within 3 business days. A machine-readable contact is at /.well-known/security.txt.