Trust & Security

Access to Project Estimator requires a signed-in account. Users can sign in with email and password or with Google.

Unauthenticated visitors are redirected to the sign-in page and cannot access any CRM data. Sessions are managed by our managed authentication provider and stored locally in the browser.

Records you create — companies, contacts, projects, quote line items, and tasks — are tagged with your user account at the moment of creation. Row-level security policies in the database ensure that you can only read, edit, or delete records that you own.

Contacts inherit access from their parent company, and quote items inherit access from their parent project, so related data stays consistent with ownership.

Application data is stored in a managed Postgres database provided through Lovable Cloud. The application itself runs on a serverless edge runtime. Anonymous database access is disabled — every read or write requires a valid user session.

We do not currently sell, share, or use your CRM data for advertising. Backups and infrastructure security are handled by the underlying platform.

Project Estimator has not been independently audited and is not certified against SOC 2, ISO 27001, HIPAA, PCI, or similar frameworks. References to platform features on this page describe enabled controls — they are not a certification or guarantee.

Customers remain responsible for the data they enter, who they invite, and how they use the application.

If you believe you've discovered a security issue, please contact the project owner directly. Include steps to reproduce the issue and any relevant details so we can investigate quickly.