Each account's data kept separate in the database
Every Obraups account runs on the same application, but the database itself keeps each account's data apart using row-level security controls. Access is limited to one account at the database connection, not filtered case by case in application code, so a mistake in one query can't return another account's records.
Encrypted in transit
Traffic between your browser and Obraups, including the staff application and each business's customer-facing pages, is encrypted over HTTPS. HTTP Strict Transport Security tells browsers to use only HTTPS connections.
Browser protections
A Content Security Policy limits what pages can load, and pages can't be embedded in frames on other sites. Obraups loads no analytics, advertising or third-party scripts, fonts or content networks.
Sign-in sessions
Staff stay signed in with one session cookie that page scripts can't read. It is sent only to the sign-in service and expires after 7 days. If you forget your password, you can ask for a reset link by email. It works once, expires after 60 minutes, and ends your other sessions within 15 minutes when you use it.
Job photo storage
Uploaded photos are checked by their content, not just their file name, and only JPEG, PNG and WEBP images are accepted. Photos count against a storage limit per account, and each job can hold up to 20 photos.
Abuse prevention
The contact form on each business's site, the public estimate pages, signup, email verification and password reset are rate-limited to slow down automated abuse without getting in the way of a real person. Signup codes expire after 15 minutes and allow five tries.
Logs
We log each request and each error so we can investigate problems and misuse. Request and error logs are deleted after 180 days. Our Privacy Policy explains what they contain.
Reporting a concern
If you think you've found a security issue, email [email protected] with what you found and how to reproduce it. Please don't access or change other people's data, and give us a reasonable time to fix the issue before sharing it. Our contact details are also published in security.txt.