Security
Names, addresses, phone numbers, photos of the inside of people’s garages, and what they paid. Here is how that is handled, in plain terms.
Every customer, door, job, estimate, invoice and photo belongs to exactly one company. The database connection the application uses is scoped to your company before a query is written, so a request for somebody else’s record does not return the wrong answer — it returns nothing. This is enforced in one place rather than remembered screen by screen, and it is covered by tests that deliberately try to reach across the boundary.
Owner, admin and technician are different. A technician can do their work — jobs, inspections, estimates, photos, the parts on their truck — without being able to change your pricing, see your revenue, or manage your team. Permissions are checked on the server for every action, not just hidden in the interface, so a URL typed by hand is refused the same way a missing button is.
When you send an estimate or an invoice to a customer, the link carries a long random token. Only a hash of that token is stored, so the link cannot be reconstructed from the database. It opens that one document and nothing else — no account, no other customer, no part of your business — and it stops working after it expires.
Customer Presentation Mode locks the device to a single estimate. Navigating anywhere else is refused by the server, not just hidden, and photos are limited to the ones on that estimate. Getting back out needs a technician password. The customer can read, choose and sign; they cannot browse.
Job and door photos are stored in private object storage, not on a public web address. The application hands out short-lived links to the specific person who is allowed to see a specific photo, so an address that leaks stops working rather than staying open.
Card details are entered on Stripe’s own pages, never on ours. Your subscription is billed by Stripe; your customers pay you through your own connected Stripe account, where your business is the merchant of record. Garage Door HQ stores the card brand and the last four digits for recognition and nothing else — no number we could charge with.
The signature is stored with the estimate and with the specific option the customer chose, at the moment they chose it. Estimate and invoice numbers are assigned once and never reused or renumbered, so a document a customer already has keeps the number it was sent with.
Passwords are stored hashed, never in a form anyone can read. Changing a password, or resetting it, immediately signs out every other session on every other device — so a phone left in a van is handled by changing a password rather than by hoping.
No software is unbreakable, and anyone who tells you theirs is has told you something useful about themselves. Garage Door HQ is built carefully, tested adversarially against the failures that would matter most to you, and reviewed when it changes — but it is software, written by people, and that is the honest size of the promise.
We do not hold a compliance certification, and we will not print a badge for an audit nobody has carried out. If that is a requirement for your business, tell us and we will give you a straight answer about where we are rather than a reassuring one.
If you believe you have found a security problem, please report it to us before publishing it. We will acknowledge it, tell you what we find, and fix it.