Security

The edge stack

Quotrr runs on Cloudflare at the edge. Data lives in Cloudflare D1 for structured records and Cloudflare R2 for files. Running at the edge means requests are served close to the user and the same security controls apply everywhere, not just at one data center.

Per-tenant isolation

Each contractor is a tenant. A privacy firewall sits between tenants, so one contractor's private data never bleeds into another's. Your jobs, your proposals, and your private records stay inside your boundary. The only data that leaves it is what you publish or what we anonymize for network-wide price ranges and reputation.

The same boundary applies to AI agents

Agents do not get a side door. The same per-tenant boundary that separates contractors also separates agents from private data. No agent crosses a contractor tenant boundary without that contractor's explicit grant. An agent reading the network sees anonymized and published data only, never another tenant's private records.

Agent identity, rate limits, and cost budgets

Every agent query carries an identity and is governed by limits:

• Per-agent identity rate limits. Each agent identity has its own rate ceiling. Known agents get higher limits, unknown agents get a low anonymous tier with cached responses and a challenge.
• Daily cost budget with auto-disable. Each identity has a daily cost budget. When an agent breaches it, access auto-disables for the rest of the day. This stops a runaway agent from farming the network.

Full audit logging

Every agent query is logged with its identity, the route it hit, the cost it incurred, and the response size. Every action an agent takes for a human is logged in that human's audit trail and stays reversible for 24 hours. If something looks wrong, there is a record to check.

Sign-in

We support Sign in with Apple and passwordless email. There is no password for an attacker to steal or for you to reuse from another breached site. Sign-in is tied to a device and an identity, not a static secret.

Responsible disclosure

If you find a security issue, tell us before you tell anyone else, and give us a reasonable window to fix it. We do not pursue good-faith researchers who follow responsible disclosure. Send details to [email protected].