Security for roofing request follow-up.
Kaldwick protects homeowner requests, contractor workspaces, CRM tokens, billing events, consent evidence, and launch-test data with practical controls designed for residential roofing teams.
Governance, risk and compliance
Honest security posture.
Kaldwick has not claimed SOC 2 Type II or ISO 27001 certification. This page documents current controls and the certification status that applies today.
SOC 2 readiness
Kaldwick is not currently SOC 2 certified.
ISO 27001
Information security management certification is a future milestone, not a current claim.
Privacy and consent
Product flows include privacy pages, Terms, consent capture, and separate launch-test records.
Security you can build on
Controls for request follow-up.
The biggest security risk in this product is mishandled homeowner data. Kaldwick turns that risk into explicit controls around authentication, workspace boundaries, consent, CRM, billing, and launch tests.
Authentication and workspace isolation
Kaldwick uses Supabase Auth, server-side session checks, and organization-scoped data access for contractor workspaces.
Row Level Security and service boundaries
Organization-scoped access controls and Row Level Security support workspace data boundaries. Elevated access is limited to trusted server routes such as public form submissions, webhooks, and background jobs.
Encrypted integration tokens
HubSpot OAuth tokens are encrypted before storage. The app treats HubSpot access as sensitive infrastructure, not ordinary profile data.
Signed webhooks
Billing events are accepted only through signed Lemon Squeezy webhooks, and event processing is idempotent to reduce replay and duplicate-event risk.
Security headers
Production responses include hardened browser headers such as CSP, HSTS, X-Frame-Options, Referrer-Policy, COOP, and permissions policy controls.
Launch test separation
Launch test requests are marked separately from homeowner requests so teams can inspect test results without treating them as homeowner demand.
Responsible disclosure
If you believe you found a vulnerability in Kaldwick, please report it responsibly. Do not access, modify, exfiltrate, or delete customer data. Do not run destructive tests or disrupt service.
kdaki@getkaldwick.comReview priorities
Secure software development
Public submission and integration routes validate inputs server-side, and private credentials remain on server-side routes.
CRM and payment safety
HubSpot connection, billing checkout, and webhook processing run through server-side routes with explicit configuration checks.
Consent and audit context
Quote forms can store consent text, version, timestamps, form URLs, user-agent context, HubSpot status, activity timelines, and launch-test context.
Responsible disclosure
Kaldwick does not run a public paid bug bounty. Security reports can be sent by email.
Subprocessors directory
Providers that help operate Kaldwick.
Vercel
Application hosting and edge delivery
Supabase
Authentication, database, storage, and server data access
HubSpot
Optional HubSpot delivery when connected by a workspace
Lemon Squeezy
Checkout, subscription, tax, and billing operations
Optional Google sign-in and configured platform services
Resend / email provider
Transactional email when configured
Security controls
Built for a roofing request workflow.
The controls below map to real Kaldwick product surfaces: quote forms, Incoming Quotes, HubSpot, Lemon Squeezy billing, launch-test requests, and public homeowner requests.
Operational visibility
Workspace configuration and launch-test results are shown as product states for teams to review.
Integration boundaries
HubSpot and billing integrations are configured server-side and surfaced through explicit readiness states.
Public endpoint hardening
Public submission, webhook, and cron endpoints use constrained handlers, signatures where applicable, and server-side validation.
No false compliance badges
Kaldwick can show readiness and controls now, while reserving SOC 2 and ISO claims for completed audits.