Courtesy translation. The Spanish version is the authoritative text and prevails in case of any discrepancy.
Taking care of your data is part of the service. This page explains which measures we apply, what their limits are and how you can tell us if you find a problem.
1. How we protect data
- Encrypted connection: the site is only served over HTTPS and tells browsers never to fall back to HTTP (HSTS, 2 years).
- Security headers: a content security policy (CSP) limiting where code, images and connections can load from; blocking other pages from embedding the site; and control over what is shared when navigating.
- Passwords: never stored in plain text, only a hash that cannot be reversed; minimum 10 characters. There is no public sign-up: only an administrator creates accounts.
- Sessions: a session cookie with the Secure (HTTPS only) and HttpOnly (not readable by scripts) attributes, and protection against requests from other sites (CSRF).
- Attempt limits: repeated sign-in attempts are blocked (5 per minute) and abuse of public forms is limited (for example, a maximum of quote requests per hour from one connection).
- Least privilege: each role sees only what it needs and this is always enforced on the server, not just on screen. A crew only sees its own team's projects and cannot see customer prices or requests.
- Data validation: everything that reaches the server is validated before use.
- Traceability: status changes on a request are logged with who made them and when.
- Secrets outside the code: keys and credentials live in the provider's environment variables, not in the repository.
2. Data we do not store
- The bill you upload: it is used to read consumption and tariff and is not stored.
- Your IP address on public requests: we only keep a code derived from it (salted hash) to limit abuse. For staff, sessions do record the IP and browser.
- Card or payment data: the site does not ask for it.
3. Infrastructure and providers
The site is hosted on Vercel and the database on Neon (on Amazon Web Services). Bill reading uses an AI model provider through Vercel AI Gateway. We chose providers with published security practices, including encryption of data at rest, according to their own policies; those guarantees are each provider's and you can check them on their sites.
Details on which data each one receives are in our privacy policy.
4. If an incident happens
If we detect an incident affecting personal data, we will contain it, investigate what happened and report it to the Superintendence of Industry and Commerce and to the people affected in the cases and within the deadlines required by law.
5. Report a vulnerability
If you believe you have found a security flaw, write to edwaramayadiaz@gmail.com. We commit to acknowledging receipt within 3 business days and to keeping you informed until it is resolved. We also publish these details at /.well-known/security.txt.
To help us fix it, include:
- A description of the problem and its impact.
- Steps to reproduce it (URL, test data, screenshots).
- How we can contact you.
We ask you to act in good faith:
- Do not access, modify or delete other people's data; if you come across personal data, stop testing and let us know.
- Do not run tests that degrade the service (denial of service, mass requests) or social engineering against staff.
- Give us a reasonable time to fix the issue before disclosing it publicly.
- Flaws in third-party services (Vercel, Neon, OpenStreetMap, etc.) are out of scope: report them to their owners.
If you act this way, we will not take legal action against you for the research.
6. What you should know
No system is completely secure. We review and improve these measures continuously and update this page when they change. To learn how we process your personal data, see the privacy policy.