Security

This page describes how Dycern LLC, doing business as Xtimates, protects the information on xtimates.com and in the dashboard at https://app.xtimates.com. We're a small team, so we lean on providers that do security for a living and keep our own part simple. We'd rather tell you exactly what we do than make claims we can't show. We don't hold a SOC 2 report today.

• Everything travels over HTTPS.
• Connection tokens are encrypted at rest with AES-256-GCM.
• Each client's rows are fenced at the database with row-level security.
• Access in the dashboard is by role: owner, admin, member.
• Stripe holds every card and bank detail. We never see a full card number.
• Our database and hosting run in United States regions on Supabase and Vercel, with backups taken by the provider.
• Found a problem? Email security@xtimates.com.

The accounts you connect (Google, Meta, HubSpot, GoHighLevel, Jobber, Google Sheets) stay where they are. We read from them with the access you grant and keep a copy of the metrics in our database.

• In transit: the website and the dashboard only load over HTTPS (TLS), and so do our calls to every provider.
• Connection tokens at rest: the OAuth tokens for Google, Meta and your CRM are encrypted with AES-256-GCM before they're stored. The key lives in the host's environment settings, never in the database or the browser.
• Database at rest: the provider encrypts the database and its backups at rest.
• Passwords: handled by our sign-in provider and stored only as salted hashes. We never see them. Password-less connect links are signed and expire.

• Row-level security. Every table that holds client data has policies at the database that only return rows for the signed-in person's company. A bug in the application can't leak another client's rows past the database.
• Roles. An owner can do everything, including billing and deleting the account. An admin runs the account day to day. A member can see and update estimates. You invite and remove people in Settings › Team.
• Staff access. Our team reaches client accounts through a staff console with its own roles. We open a client's data to set up, to answer a support request, to review a flag, or to run billing. Stage and source changes record who made them and when.
• Provider accounts. Our Supabase, Vercel, Stripe, Resend, Google and Meta accounts use two-step sign-in and are limited to the people who need them.

Our payment form uses Stripe's payment element, so card and bank details go from your browser to Stripe. Our servers receive a token and a record of the payment: amount, date, and the last 4 digits of the card or the bank's name. Stripe is a PCI DSS Level 1 service provider. Nothing is charged without a person at Xtimates doing it.

The database is backed up by Supabase on its schedule, encrypted, in the same United States region. We test restoring from a backup when we make schema changes. The website and the dashboard are served by Vercel across several locations. When the dashboard is down, your ads keep running in your own accounts and your website keeps taking requests, which arrive once it's back.

• Google and Meta connections use OAuth. We ask for read scopes only, for the products you pick. We never ask for your password.
• You can see and remove our access at any time: in Settings › Connections, at myaccount.google.com/permissions, or in Facebook under Settings › Business Integrations.
• Disconnecting deletes the token immediately. The Data Deletion page covers what happens to the synced data.

• Every change goes through a branch, a review, and a preview deployment before it reaches production. Nobody commits straight to production.
• Secrets live in the host's environment settings and are never committed to code.
• Dependencies are kept current and checked for known vulnerabilities.
• Form endpoints and the usage API are rate-limited and check a secret or an API key.
• Every input is validated on the server, and every value read back from a cookie is re-checked before it reaches a page.

If we confirm a breach that affects client data, we fix the cause, tell the clients affected within 72 hours of confirming it, as the Data Processing Addendum (xtimates.com/legal/dpa) promises, and meet the notice rules in the law. If it affects people who aren't clients, we tell them too. We write down what happened and what we changed.

If you find a security problem on xtimates.com or in the dashboard, email security@xtimates.com with what you found, the steps to reproduce it, and how to reach you. We reply within two business days, keep you posted while we fix it, and credit you if you'd like.

• Please give us a fair chance to fix it before telling anyone else.
• Don't access, change or delete other people's data, disrupt the service, or test with real customers' information.
• Stop and tell us as soon as you've shown the problem exists.
• We won't take legal action against anyone who reports in good faith and follows these rules.

We don't run a paid bug bounty program today.

Xtimates doesn't hold a SOC 2 report today. Whether each provider we use (Supabase, Vercel, Stripe, Resend, Anthropic) holds a current SOC 2 report: Ask us for the current details. Our Google integration follows the Google API Services User Data Policy, including Limited Use, and our Meta integration goes through Meta App Review. We'll update this page if any of that changes.

Dycern LLC, doing business as Xtimates, Indiana. Security questions: security@xtimates.com.