How we protect your account and data.

Encrypted connections

Vouchfield is served over HTTPS, so what you send and see is encrypted on its way to and from our site. Once you have visited, our server also tells your browser to use only HTTPS for this site for the next year (this is called HSTS).

Every page comes with a strict content security policy: your browser runs only our own scripts and blocks scripts from other websites. Other websites cannot show our pages inside theirs, except the free-check form an agency adds to its own website and the reports that form opens. We use no advertising or analytics trackers.

Signing in

You sign in with your email address. We email you an 8-digit code that works once and expires after 15 minutes. There is no password to guess, reuse or steal. We store only a fingerprint of each code (a one-way scramble), never the code itself, and the code is never in the email's subject line.

To stop guessing, we limit how many codes can be asked for and tried each hour, for each email address and each network. After 30 wrong codes for one email address from one network in 24 hours, codes for that address are paused on that network until the oldest wrong try is a day old, so someone guessing from somewhere else cannot lock you out. The sign-in pages answer the same way whether or not an address has an account.

Recovery codes

In Account security you can make a set of recovery codes. Each one signs you in once if you can't get to your email, and it works even while sign-in codes are paused. We show them only once and store only fingerprints of them. Making a new set cancels the old ones, and using one signs you out on every other device.

Staying signed in

Signing in sets one cookie. Page scripts cannot read it, and it is sent only over HTTPS. You stay signed in for 8 hours, or 30 days if you tick “Keep me signed in on this device”. Sessions live on our server, so signing out ends one at once, and “Sign out all my sessions” in Account security ends them on every device.

Changing account security, such as making recovery codes or replacing the API key, needs a sign-in code from the last 15 minutes. Forms that change something work only when they are sent from Vouchfield's own pages.

Who can see your work

Audits started inside a workspace are private: only people signed in to that workspace can open them, unless the owner chooses to make one public. A free check run from our public website makes a report that anyone with its link can open.

The workspace owner decides who joins. An invitation lasts 14 days. Teammates can work on audits, clients, proposals and tasks; only the owner manages billing, connections, sharing and team access. Removing someone signs them out at once.

Sharing with clients

To show a client a report or a proposal, the owner makes a client link or a client portal. It shows only what the owner picked, it is read-only, and it stops working after 7, 30 or 90 days, as the owner chooses. The owner can switch it off at any time. We store only a fingerprint of each link, so the full link is shown once.

API keys

Each workspace has an API key: a long random key that is shown once. We store only a fingerprint of it. Anyone who has the key can open the workspace, so keep it in a password manager. The owner can replace it in Account security, which stops the old key at once.

Where your data is kept

Render hosts the website and its database in the United States. Twice a day a short-lived GitHub computer copies the database, encrypts the copy with AES-256 and stores it with Cloudflare R2, then is wiped. The key that unlocks backups is kept as a GitHub secret and is never kept on the website's server. When an agency connects Google or HubSpot, the lasting key for that connection is stored encrypted. Google's short-term keys, which stop working within an hour, are not. The privacy page says what we keep, for how long, and which companies help run the service.

Payments

Card payments are handled by Stripe. You type your card details on Stripe's own page, not on ours, so card numbers never reach Vouchfield. We keep only Stripe's references for your subscription and whether it is paid.

What we don't do yet

• The operator account, which Vouchfield uses to run the service, signs in with a password, not an emailed code. It can open private reports in every workspace. Sign-in attempts with a password or API key are limited to 10 an hour from one network, and the password itself is not stored in our database.
• There is no separate second sign-in step, such as an authenticator app. Your email account is the key to your Vouchfield account, so protect it with a strong password and two-step sign-in.

Report a security problem

If you think you've found a security problem, email vouchfieldapp@gmail.com with what you found and the steps to see it. We reply within 2 business days. Please don't look at or change other people's data, don't slow the service down, and give us time to fix the problem before telling anyone else. The same contact details are in /.well-known/security.txt.