Security at RoofPilot AI
Last updated: August 2026
We build RoofPilot AI the way we'd want a vendor to build software that talks to our customers: conservatively, transparently, and without exaggerating. Here's what we actually do — no unverifiable badges, no invented certifications.
Tenant isolation (RLS)
Every workspace's data is protected by PostgreSQL Row Level Security. Your organization can only ever read or write its own rows — enforced by the database itself, not by application code.
Secrets stay server-side
Service keys and SMTP credentials stay server-side and are never exposed to your browser. Sensitive integration credentials use protected server-side secret storage.
Encrypted authentication
Passwords are handled by Supabase Auth and stored hashed — never in plain text. Sessions use secure, HTTP-only cookies.
Least-privilege APIs
Public endpoints (trial, contact) validate input, accept only what they need, and have no read access to workspace data.
Transparent demos
The product tours on this site run on clearly-labeled synthetic data. No real customer information is ever used for marketing.
You control your data
Delete individual leads anytime from your dashboard. To export or delete your whole organization/workspace, contact us through the Contact page — we handle verified requests under our data-retention process.
Reporting a vulnerability
If you believe you've found a security issue, please report it through the Contact page with the subject "Security". We investigate every report and respond promptly. Please give us a reasonable window to address issues before public disclosure.
Roadmap commitments
Formal compliance programs (like SOC 2) are on our roadmap. Until an audit is complete, we won't claim it — and we suggest you hold every vendor to the same standard.