Security

We apply layered administrative, technical, and physical safeguards designed to protect customer data against unauthorized access, loss, and misuse. We treat security as an ongoing practice and regularly review and improve our controls.

In transit, we use TLS/HTTPS encryption for our website and APIs. At rest, we rely on platform-managed encryption where applicable for data we store on the managed backend.

Passwords are not stored in plain text. User authentication is handled through the platform's managed authentication provider rather than our own code.

Access to customer data is restricted on a least-privilege basis. Access to production systems is limited to authorized personnel and is reviewed periodically. Row-level security policies help ensure each customer can only access their own data.

Our platform is hosted on managed infrastructure that provides monitoring, backups, and availability tooling. We aim for high availability but cannot guarantee uninterrupted service; we work to restore service quickly if an incident occurs.

We encourage responsible disclosure of security issues. If you believe you have found a vulnerability, please contact us privately using the details below and allow us a reasonable window to respond before any public disclosure.

If a security incident affecting customer data is confirmed, we work to identify, contain, and remediate it, and will notify affected customers as required by applicable law.

Security is shared. Use strong, unique passwords, enable multi-factor authentication where available, limit access to your account to people who need it, and keep your devices and browsers updated.

For security questions or to report a vulnerability, contact us at hello@comfortprohvac.example. We take reports seriously and will acknowledge them as soon as we can.