Security

Your quotes, rates and customers, kept safe

Your rates and margins are the most sensitive numbers in your shop. This page sets out what Spindlewise does to protect them, in plain terms. It describes what is in place today; we do not hold security certifications, and we will not imply that we do.

Your data stays yours

• Your quotes, rates and customers are never shared with other shops, never used to match you with buyers, and never used to train third-party AI models.
• You can download everything at any time from Settings, as CSV and JSON in one file, including the attachments. That works on every plan, and for 30 days after you leave.
• After that, your data is deleted from the live system within 60 days, and from backups within a further 35 days.

Each shop is walled off

• Every workspace is separated inside the database itself, not only in the application, so one shop's records cannot be read from another shop's account.
• Every request is checked against the user's role in that workspace.
• Automated tests check this separation before every release.

Roles that hide what people don't need to see

• Owners, admins and estimators see costs and margins.
• Sales staff see prices but not costs.
• Operators on the floor see their jobs, drawings and time logging, and never a price.
• Viewers can look but not change anything. Owners and admins can see who changed what, and when.

Quotes that can't be changed after the fact

• An approved quote version is frozen. Changing it means a new version; the issued one stays as it was.
• The customer PDF can be rebuilt exactly, and is checked against a fingerprint taken when it was issued.
• The link a buyer opens shows prices and terms only. It uses a long random code that we store only in scrambled form, expires with the quote and can be withdrawn.

Signing in

• Passwords are handled by our sign-in provider and stored only as a secure hash.
• Every user can turn on two-step verification with an authenticator app. Once it is on, the server refuses requests that have not passed the second step.

Connections, files and servers

• Every connection is encrypted (HTTPS), and stored data is encrypted by our database provider.
• The application server accepts no connections from the internet; traffic reaches it through an encrypted tunnel.
• Drawings and models are stored privately under random names. 3D models and drawings are read on our own server, in separate processes with time and memory limits, and are not sent to outside AI services.
• Public forms, such as a shop's quote request page, are limited by rate and checked for spam.

Backups and monitoring

• The database is backed up every night. Once a month a backup is restored automatically into a separate database and every table is checked.
• The service is checked every five minutes, from our server and from outside, and we are alerted when something is wrong.
• The software components we rely on are checked every week against public vulnerability databases and updated.

What Spindlewise is not for

Spindlewise is not set up for export-controlled or classified technical data, such as work under ITAR or Canada's Controlled Goods Program. Quote those jobs outside Spindlewise. The acceptable use policy lists the regimes.

More detail

Where data is stored and which providers process it are set out in the privacy policy and the data processing addendum, which also lists our security measures and our commitment to tell you about a security incident within 48 hours.

Think you have found a security problem? Email [email protected] with the details. We will not act against good-faith reports.