Small surface, honestly described
This site is a marketing site with a sign-up form, a contact form and a form for a business to correct or remove the details we hold about it, plus a member area at /members/ where trial customers log in to run the product, an agency console at /agency/ for the web agencies that resell it to their own clients, and a unified sign-in at /login/ that serves both of those and our own admin. While our Team desk is open, our team members sign in to it at /team/login/, a sign-in of its own that asks for a password and then a code from an authenticator app. There are member accounts and logins now — but still no card fields anywhere: we take no card for a trial or a plan, and a contractor who connects its own Stripe account sends its customers to Stripe’s own checkout page to pay its invoices, so card data never touches our systems. The fewer doors we build, the less there is to defend.
Some doors are public on purpose, and each has guards of its own. The applicant screening page under /members/ is cookieless, needs no login and is rate-limited, because a job applicant should not have to create an account to answer six questions. The Field Notes newsletter sign-up at /newsletter/ sets no cookie, has a honeypot field and a timing check, and caps sign-ups per connection and confirmation emails per address and per day; the newsletter goes only to an address that was confirmed, by opening the link we email to it and pressing its button. The quote form a contractor puts on its own website sends what a homeowner types to /widget/quote.php, which sets no cookie, quotes only for a business in its trial or on a plan that includes the quote form, checks every answer on the server, and caps the quotes and messages from one connection each hour.
A few pages open from a link with no login, because the link carries a long random code that is the key: a customer’s estimate under /e/, a customer’s invoice under /i/, and a contractor’s calendar feed under /cal/. A homeowner’s own visit, also under /cal/, is a calendar file whose link is signed instead, so it stops working once the visit is moved, cancelled or marked done, and 12 hours after its start at the latest. A link that is unknown or no longer good gets a plain answer that says so, and search engines are told not to index any of these pages. That is not every address the site answers: the others are smaller, such as the unsubscribe link in our emails, which works only with the code in that link and does only that one thing, and the addresses our phone carrier sends calls and texts to, which refuse any request the carrier did not sign.
What the sign-up and contact forms do collect between them — your name, company, website, email, phone, trade, city, state, ZIP, plan interest and message, a mobile number for our own texts on the trial form (kept only when you tick the box to agree to them), plus the submitting IP address and a timestamp — is treated the way we would want our own details treated. The sections below describe exactly how, and every claim on this page describes something that exists in the code right now.
The site also counts its own visitors, with analytics we wrote and host ourselves rather than Google’s. Those pageview records carry no name, email or phone, and the visitor’s IP address is deleted as soon as an optional location lookup completes. Every field is listed in the privacy policy, and the cookies behind it in the cookie policy.
Vendor security pages tend to be written by the marketing department. This one was written by the people who built the form.
What this page is
A plain-English description of our current practices, published for transparency. It is not legal advice, not a certification, and not a contract term. Like the rest of our policy pages, it is written and reviewed by us.
It will be updated as practices change — including the “what we do not have yet” section, which we intend to shrink over time rather than delete.
What happens when you hit submit
Four checks stand between the sign-up and contact forms and the database. All of them run on the server, where you cannot switch them off from a browser. The form for a business to correct or remove its details gets the same four, and more: a honeypot field and a timing check, a link emailed to the typed address that must be clicked before a request counts, and caps per address, per business, per connection and per day, so it cannot be turned into a mail cannon. A request is stored even when a cap refuses to email about it, so none is ever lost.
Validated
Every field is checked on the server — types, lengths, formats. Browser-side validation is a convenience; the server-side check is the one that counts, and it runs on every submission no matter what sent it.
Parameterized
Database queries use bound parameters. What you type is handed to SQL Server as data, never spliced into the query text — which is the boring, standard, correct defense against SQL injection.
CSRF-checked
Every form carries a token tied to your session. A post that arrives without the right token is refused, so another site cannot submit our forms on your behalf from your browser.
Rate-limited
Trial and partner submissions are limited per IP address. One visitor asking a question looks nothing like a script hammering the endpoint, and the second one gets slowed to a stop.
Where your information lives
Form submissions are stored in a private Microsoft SQL Server database on servers in the United States operated for us by Data Processing LLC, our affiliated hosting company. The application only speaks to it in the parameterized queries described above. The member area and the agency console add accounts and team logins, business settings, leads, applicants, message logs, webhook configuration, partner branding and partner invoice documents to that same private database; member, agency and administrator passwords are stored only as salted hashes, never in the clear, and member sessions time out on idle and at a hard maximum lifetime. A member login can also turn on two-step login from its Account page: after the password, the sign-in then asks for a six-digit code from an authenticator app on the member's phone, or one of ten one-time recovery codes, and each code works only once. The app's key is stored encrypted and the recovery codes only as one-way hashes. If the phone is lost and no recovery code is left, we clear that login's two-step login only after its own email address answers an email we send to it.
The data is used to respond to you, set up the trial you asked for, and run the business. It is not sold, not shared with advertisers, and not used for anyone else’s marketing. We keep it until the business relationship ends or you ask us to delete it — one email to support@tailgateoffice.com does it.
The analytics pageview records sit in that same private database on the same servers — self-hosted, with no analytics vendor holding a copy, deleted automatically after 730 days by default. They are never joined to a form submission, so there is no path from a visit record back to a person.
The full data story — what is collected, why, and your options — is in the privacy policy. This page covers the locks; that page covers the contents.
No card data. Anywhere.
We take no payment for our own plans on this site, and the free trial does not ask for a credit card. A customer paying a contractor’s invoice pays on Stripe’s own checkout page, into the contractor’s own Stripe account; we have no checkout page of our own, and no payment card data touches our systems.
A breach cannot leak what was never collected. The honest summary of our card-data security is that there is no card data here.
Hardening that is actually in place
Unglamorous, verifiable, running today.
Security headers on every response
X-Frame-Options DENY, so our pages cannot be framed for clickjacking. X-Content-Type-Options nosniff, so browsers do not second-guess file types. A Referrer-Policy that keeps your browsing details out of other sites' logs. Strict-Transport-Security, so a browser that has been to www.tailgateoffice.com once only ever goes back there over HTTPS. A Permissions-Policy that switches off the camera, microphone, location and payment APIs, which nothing here uses. And on the member, agency and admin areas a Content-Security-Policy that forbids framing, plugins and base-address tricks.
Errors logged privately, never displayed
When something breaks, the details go to a private log for us to read. Visitors never see a stack trace, a query fragment or a file path — the classic freebies that make an attacker's job easier.
Admin area locked down
The administrative area sits behind authentication. An address that keeps failing is refused for fifteen minutes, and the office is emailed when one admin login sees ten wrong passwords. The admin logins themselves are never locked, so nobody can lock the office out by guessing.
Seven cookies at most, all flagged HttpOnly
One session cookie for form security and for the member, agency and admin logins, and two random IDs for our own visitor counting. While our Team desk is open, two more: one that holds a team member's short code, set only when you open our site through that member's link, and the desk's own sign-in, sent only to its pages. And two that are only ever set in our own administrators' browsers: one so our clicking is excluded from the visitor numbers, and one that lets an administrator preview pages that are not public yet. All of them are HttpOnly — scripts in the page cannot read them — plus SameSite=Lax, and Secure over HTTPS. They are first-party, none of them holds anything about you, and there are no third-party cookies in the jar at all.
Transport encryption on the production domain
The production domain runs HTTPS, so what you type travels encrypted between your browser and the server. Stated precisely on purpose: transport encryption is what we claim, because it is what is true.
Quote photos in a private bucket, switched off for now
Photo uploads are switched off for now, so a quote form takes no photos. When they are on, a quote form's photos go to a private Amazon S3 bucket with all public access blocked and Amazon-managed encryption at rest. The inbox shows them through signed links that expire within about an hour, and the server's key can read, write and delete files only in its own folders of that one bucket: it cannot list the bucket.
What we do not have yet
A security page that only lists strengths is an advertisement. Here is the other column, stated plainly, so you can size us up accurately.
None of these are secrets and none of them are permanent. A formal penetration test is planned as the product matures, and this list will shrink as the business grows into each item honestly — certifications after audits, not before.
In the meantime, we would rather you trust the short true list on this page than a long aspirational one.
Not yet on the shelf
Found a hole? Tell us. We will say thank you.
If you find a vulnerability in this site, we want to hear about it directly — before anyone else does, ideally including our own logs.
Email support@tailgateoffice.com with SECURITY in the subject line (the same address is in /.well-known/security.txt). That word gets the message read first. We respond within one business day, and the response comes from a person who understood the report.
To be plain about the ground rules: we do not make legal threats against good-faith reporters. If you found something while poking honestly and told us instead of exploiting it, you are doing us a favor and we will treat it that way. There is no bounty program yet — see the list above — so what we currently pay in is gratitude and a fast fix.
A useful report has
One ask in return
Demonstrate, do not exploit. If a flaw exposes data that is not yours, stop at proving it exists — do not download it, alter it or pass it around. That is the line between a good-faith report and the other kind.
Looking for the texting rules?
TCPA, carrier registration, STOP handling and quiet hours are a different subject with their own page, and it is one of the most thorough pages on this site. The whole story is at our compliance page — how consent works, what we file on each customer’s behalf, and why the platform only texts about a call, quote, application or job on your account.
Boring security. Busy phones.
The trial collects no card because there is nothing to charge. 30 days, cancel from the dashboard, and every claim on this page stays true the whole time.