Trust, Security & Privacy
We take the security and privacy of your data seriously. This page explains the controls we apply and what you can expect from us. It is maintained by Winstream SA and is not an independent certification.
Authentication & Access
- Email/password and Google sign-in via a managed authentication provider.
- Sessions use signed tokens; passwords are never stored in plain text.
- Role-based access controls restrict privileged operations to authorized users.
Data Protection
- Data is encrypted in transit (TLS) and at rest by our managed database provider.
- Row-level security policies ensure users can only access their own records.
- Secrets and API keys are stored server-side and never exposed to the browser.
Privacy
We collect only the information needed to provide the service: account details, content you create (quotes, proposals, clients), and basic usage information. We do not sell personal data. You may request export or deletion of your account data at any time by contacting us.
Operational Practices
- Regular automated security scans of application code and dependencies.
- Principle of least privilege for server-side database functions.
- Incident response: notification of affected users for material security events.
Your Responsibilities
- Use a strong, unique password and keep your account credentials private.
- Report suspected security issues to us promptly.
Contact
Security or privacy questions? Email info@winstreamsa.co.za.