Security & trust
Your business runs on this. So does ours.
Contractors put their leads, contracts and money in Webstack. Here's exactly how that data is kept, who can see it, and what happens if you leave.
Your data is yours
Export every lead, client, estimate, job, invoice, payment and message as one file from Settings, at any time, on any plan. Cancel and take it with you — there is no exit fee and no hostage data.
One company can't see another
Every record carries the company it belongs to, and every query is scoped to the signed-in user's company. Staff roles limit what office and crew members can open; costs and margins stay with the owner.
Card details never touch us
Payments run through Stripe Connect. Card numbers go straight to Stripe and money lands in the contractor's own bank account. Webstack stores the amount and the status, never the card.
Links clients can use, and nobody else can guess
Proposals, invoices, change orders and portals open from long random links rather than accounts, so homeowners don't need a password. Signing records the name, time and IP address, and the pages are never indexed by search engines.
Secrets stay secret
Connection tokens for QuickBooks and similar services are encrypted before they're stored. API keys live in the host's environment, never in the code or the browser, and inbound webhooks are signature-checked.
Built on infrastructure you know
Webstack runs on Vercel in the United States, with a Postgres database on Neon and file storage on Vercel Blob. Traffic is encrypted end to end, and the app sends browser security headers (HSTS, frame and content-type protection, a strict referrer policy and a locked-down permissions policy). A content security policy is being rolled out next.
AI with a hand on the brake
AI features run on Anthropic's business API, which doesn't train models on the data sent to it. Anything the assistant would send to a customer — a text, an email — waits for the contractor to tap Confirm.
Honest about the stage we're at
Webstack is a young product. Our own security review of tenant isolation, payments and webhooks found no critical or high issues, and an outside review is booked before we take on customers at scale. We hold no certifications yet and won't pretend otherwise. Ask us anything at support@webstack.tech.
Questions before you trust us with the business?
Email support@webstack.tech and a human answers.