Company
Security and data protection at Quote360
Quote360 keeps each company's data in its own workspace in a managed European database, gives access through named roles, and names every provider that processes personal data in its privacy policy.
Last updated:
Where is your data stored?
The application database and the files you upload are in the European Union; product analytics and error monitoring run in the United States. This table is the same list the privacy policy carries, so the two cannot disagree.
| Provider | Purpose | Location |
|---|---|---|
| Vercel | Hosting and delivery of the website and application | Provider's own infrastructure |
| Supabase | Application database | European Union (Frankfurt) |
| Upstash | Cache, rate limiting and the quote email send queue | Provider's own infrastructure |
| Clerk | Sign-in and account management | Provider's own infrastructure |
| Resend | Email delivery: quotes, invitations, verification and contact messages | Provider's own infrastructure |
| PostHog | Product analytics | United States |
| Sentry | Error monitoring | United States |
| Google Maps | Address search and maps in the application | Provider's own infrastructure |
| HERE | Truck route distance and time for delivered prices | Provider's own infrastructure |
| TollGuru | Toll cost estimates for routes | Provider's own infrastructure |
| TaxJar | Sales tax calculation, when enabled for a company | Provider's own infrastructure |
| Google Cloud Storage | Storage of uploaded files and proposal PDFs | European Union (Frankfurt) |
| Pusher | Real-time notifications in the application | Provider's own infrastructure |
The privacy policy states what each provider receives.
Who can see a company's data?
Only its own members. Every record belongs to one company workspace, and every request is checked against that company and the caller's role before any data is read. Sign-in runs through Clerk; Quote360 never stores a password.
How are API keys protected?
A key is shown once and stored only as a bcrypt hash. It belongs to one company, acts with its owner's role permissions, and can be restricted to specific IP addresses and origins. Default limits are 60 requests a minute, 1,000 an hour and 10,000 a day per key.
How do I report a vulnerability?
Write to security@quote360.app with the steps to reproduce it. The same address is published at /.well-known/security.txt. We will confirm we received the report and tell you when it is fixed.
Questions and answers
- How long is data kept?
- While the account is active. If you delete the account, personal data is deleted within 30 days, except where we are required to keep it for legal or regulatory reasons.
- Is Quote360 SOC 2 or ISO 27001 certified?
- No. There is no certification to claim today; this page describes what is actually in place.
Related pages
- Privacy PolicyPrivacy Policy for Quote360 - Learn how CMS Hub Limited collects, uses, and protects your data.
- Terms of ServiceTerms of Service for Quote360, quoting software for heavy construction materials, operated by CMS Hub Limited.
- AboutQuote360 is sales and quoting software for heavy construction materials, built and operated by CMS Hub Limited.
- ContactWrite to the Quote360 team about quoting heavy construction materials, an account question, a security report or the press.