Security

Estiquik holds your pricing, your margins and your customers' contact details. This page describes plainly how that information is protected — and, just as importantly, what protections we do not yet have, so you can judge for yourself.

Accounts and authentication

• Sign-in is handled by Google Firebase Authentication. Passwords are hashed and salted by Google; they are never stored by us and never visible to us in readable form.
• Changing your email or password requires re-entering your current password, so a walk-up attacker at an unlocked screen cannot silently take over the account.
• Password resets are sent by email as single-use, time-limited links.

Data isolation between accounts

Every record is stored under your user ID, and Firestore security rules enforce that a request may only read or write documents belonging to the signed-in user. This is enforced on Google's servers, not in your browser — modifying the page code, using developer tools, or calling the API directly does not bypass it.

We verified this by signing in as a second account and attempting, in every case unsuccessfully, to:

• List and read another user's client records, estimates and invoices
• Read another user's profile
• Create, modify and delete records inside another user's account
• Run collection-group queries across all accounts — the usual way per-user data leaks
• Read any of the above with no login at all

All attempts returned permission-denied.

Payments

Card details are collected by Stripe and submitted directly to Stripe. Card numbers never reach our servers and are never stored by us. We hold only a Stripe customer identifier and your subscription status. Stripe is a PCI-DSS Level 1 certified provider.

Subscription state is written to your account only by server-side code responding to signed Stripe webhooks. The browser cannot grant itself a subscription — database rules block clients from writing billing fields.

Encryption

• In transit: all traffic is served over HTTPS/TLS. Firebase Hosting enforces this.
• At rest: data in Firestore is encrypted at rest by Google Cloud.

Infrastructure

Estiquik runs entirely on Google Cloud via Firebase — Authentication, Firestore, Hosting and Cloud Functions — with Stripe for payments. We do not operate our own servers. Application data is stored in a United States multi-region Firestore deployment. See Sub-processors for the full list.

Secrets and access

Server-side credentials such as Stripe API keys are held in Google Secret Manager and are available only to server-side functions. They are not present in any code delivered to your browser.

Data on your own device

The estimate and invoice you are working on are cached in your browser's local storage so the app stays fast and survives a brief connection drop. On a shared or public computer, log out and clear browser data when you finish.

What we do not have yet

What you can do

• Use a long, unique password, ideally from a password manager.
• Secure the email account tied to your login — anyone with it can trigger a password reset.
• Export backups periodically; the app exports JSON and CSV.
• Avoid entering sensitive personal information (health details, financial account numbers, government IDs) into free-text notes.
• Log out on shared devices.

Reporting a vulnerability

If you find a security problem, please report it to security@estiquik.com rather than disclosing it publicly, and give us a reasonable opportunity to fix it. We will acknowledge your report and keep you updated. We do not currently run a paid bug bounty.