Small surface, honestly described
This site is a marketing site with one contact form, plus a member area at /members/ where trial customers log in to run the product, an agency console at /agency/ for the web agencies that resell it to their own clients, and a unified sign-in at /login/ that serves both of those and our own admin. One more door is public on purpose: the applicant screening page under /members/, which is cookieless, needs no login and is rate-limited, because a job applicant should not have to create an account to answer six questions. There are member accounts and logins now — but still no payments and no card fields anywhere, because no payment processor is connected. The fewer doors we build, the less there is to defend, and online payments are a door we have deliberately not built yet.
What the form does collect — your name, company, website, email, phone, trade, city, state, ZIP, plan interest and message, plus the submitting IP address and a timestamp — is treated the way we would want our own details treated. The sections below describe exactly how, and every claim on this page describes something that exists in the code right now.
The site also counts its own visitors, with analytics we wrote and host ourselves rather than Google’s. Those pageview records carry no name, email or phone, and the visitor’s IP address is deleted as soon as an optional location lookup completes. Every field is listed in the privacy policy, and the cookies behind it in the cookie policy.
Vendor security pages tend to be written by the marketing department. This one was written by the people who built the form.
What this page is
A plain-English description of our current practices, published for transparency. It is not legal advice, not a certification, and not a contract term. Like our other policy pages, it should be reviewed by the company’s attorney before public launch.
It will be updated as practices change — including the “what we do not have yet” section, which we intend to shrink over time rather than delete.
What happens when you hit submit
Four checks stand between the form and the database. All of them run on the server, where you cannot switch them off from a browser.
Validated
Every field is checked on the server — types, lengths, formats. Browser-side validation is a convenience; the server-side check is the one that counts, and it runs on every submission no matter what sent it.
Parameterized
Database queries use bound parameters. What you type is handed to SQL Server as data, never spliced into the query text — which is the boring, standard, correct defense against SQL injection.
CSRF-checked
Every form carries a token tied to your session. A post that arrives without the right token is refused, so another site cannot submit our forms on your behalf from your browser.
Rate-limited
Trial and partner submissions are limited per IP address. One visitor asking a question looks nothing like a script hammering the endpoint, and the second one gets slowed to a stop.
Where your information lives
Form submissions are stored in a private Microsoft SQL Server database on servers in the United States operated for us by Data Processing LLC, our affiliated hosting company. The application only speaks to it in the parameterized queries described above. The member area and the agency console add accounts and team logins, business settings, leads, applicants, message logs, webhook configuration, partner branding and partner invoice documents to that same private database; member, agency and administrator passwords are stored only as salted hashes, never in the clear, and member sessions time out on idle and at a hard maximum lifetime.
The data is used to respond to you, set up the trial you asked for, and run the business. It is not sold, not shared with advertisers, and not used for anyone else’s marketing. We keep it until the business relationship ends or you ask us to delete it — one email to support@tailgateoffice.com does it.
The analytics pageview records sit in that same private database on the same servers — self-hosted, with no analytics vendor holding a copy, deleted automatically after 730 days by default. They are never joined to a form submission, so there is no path from a visit record back to a person.
The full data story — what is collected, why, and your options — is in the privacy policy. This page covers the locks; that page covers the contents.
No card data. Anywhere.
Nothing on this site takes a payment. The free trial does not ask for a credit card, there are no checkout pages, and no payment card data touches our systems.
A breach cannot leak what was never collected. Until we take payments online, the honest summary of our card-data security is that there is no card data.
Hardening that is actually in place
Unglamorous, verifiable, running today.
Security headers on every response
X-Frame-Options DENY, so our pages cannot be framed for clickjacking. X-Content-Type-Options nosniff, so browsers do not second-guess file types. A Referrer-Policy that keeps your browsing details out of other sites' logs. Strict-Transport-Security, so a browser that has been to www.tailgateoffice.com once only ever goes back there over HTTPS. A Permissions-Policy that switches off the camera, microphone, location and payment APIs, which nothing here uses. And on the member, agency and admin areas a Content-Security-Policy that forbids framing, plugins and base-address tricks.
Errors logged privately, never displayed
When something breaks, the details go to a private log for us to read. Visitors never see a stack trace, a query fragment or a file path — the classic freebies that make an attacker's job easier.
Admin area locked down
The administrative area sits behind authentication. An address that keeps failing is refused for fifteen minutes, and the office is emailed when one admin login sees ten wrong passwords. The admin logins themselves are never locked, so nobody can lock the office out by guessing.
Four cookies at most, all flagged HttpOnly
One session cookie for form security and for the member, agency and admin logins; two random IDs for our own visitor counting; and a fourth that is only ever set in our own administrators' browsers, so our clicking is excluded from the visitor numbers. All of them are HttpOnly — scripts in the page cannot read them — plus SameSite=Lax, and Secure over HTTPS. They are first-party, they hold no personal data, and there are no third-party cookies in the jar at all.
Transport encryption on the production domain
The production domain runs HTTPS, so what you type travels encrypted between your browser and the server. Stated precisely on purpose: transport encryption is what we claim, because it is what is true.
Quote photos in a private bucket — not switched on yet
Photo uploads are not switched on, so no homeowner photo has been stored and no bucket exists yet. When they are switched on, a quote form’s photos go to a private Amazon S3 bucket with all public access blocked and Amazon-managed encryption at rest. The inbox shows them through signed links that expire within about an hour, and the server's key can only read, write and delete objects in that one bucket: it cannot list the bucket or touch anything else in the account.
What we do not have yet
A security page that only lists strengths is an advertisement. Here is the other column, stated plainly, so you can size us up accurately.
None of these are secrets and none of them are permanent. A formal penetration test is planned as the product matures, and this list will shrink as the business grows into each item honestly — certifications after audits, not before.
In the meantime, we would rather you trust the short true list on this page than a long aspirational one.
Not yet on the shelf
Found a hole? Tell us. We will say thank you.
If you find a vulnerability in this site, we want to hear about it directly — before anyone else does, ideally including our own logs.
Email support@tailgateoffice.com with SECURITY in the subject line (the same address is in /.well-known/security.txt). That word gets the message read first. We respond within one business day, and the response comes from a person who understood the report.
To be plain about the ground rules: we do not make legal threats against good-faith reporters. If you found something while poking honestly and told us instead of exploiting it, you are doing us a favor and we will treat it that way. There is no bounty program yet — see the list above — so what we currently pay in is gratitude and a fast fix.
A useful report has
One ask in return
Demonstrate, do not exploit. If a flaw exposes data that is not yours, stop at proving it exists — do not download it, alter it or pass it around. That is the line between a good-faith report and the other kind.
Looking for the texting rules?
TCPA, carrier registration, STOP handling and quiet hours are a different subject with their own page, and it is one of the most thorough pages on this site. The whole story is at our compliance page — how consent works, what we file on each customer’s behalf, and why the platform refuses to text strangers.
Boring security. Busy phones.
The trial collects no card because there is nothing to charge. 30 days, cancel from the dashboard, and every claim on this page stays true the whole time.