How we protect your shop's data
JamQuote holds your customers' names, numbers, addresses, photos and payments, so we treat all of it as sensitive. Every connection is encrypted, each shop's records are walled off from every other shop's, passwords and keys are stored hashed, and nightly backups are kept 30 days.
Updated
Encryption
- TLS on every connection, with certificates from Let's Encrypt.
- Passwords are stored as salted hashes, never in plain text. API keys are stored hashed; the secret is shown once, when you create it.
- Credentials for phone and payment providers are encrypted in the application before they are stored.
- Two-factor sign-in and passkeys are available on every account.
Separation between shops
Every record belongs to one shop, and the application enforces that boundary on every read and write, so one shop cannot see another's records. Each person's role in a shop decides what they can see and change.
Payments
Card details never touch our servers. Customers pay through Stripe, into your own Stripe account; we keep only Stripe's ids and the payment status.
Logs and analytics
- Logs are kept 90 days, with passwords, tokens, keys and cookies redacted. Text message bodies and phone numbers never reach the logs.
- This website sets no cookies and never identifies a visitor.
Hosting and backups
JamQuote runs on dedicated servers at OVH. The database is reachable only over a private network. Nightly backups go to Cloudflare R2 and are kept 30 days.
Your data, your call
Export everything about you and your shop as a file from Settings, or delete your account from the same place. Deletion removes your shop's records and photos; backups age out within 30 days.
Reporting a security issue
Found something? Tell us through the contact form and choose "A security report". We reply by email.