YOUR DATA IS SAFE WITH US
Security at LaborProof
We handle sensitive insurance documents on behalf of contractors and their subcontractors every day. Here is exactly how we protect your data.
Encrypted Storage
All documents stored with AES-256 encryption at rest.
Row-Level Security
Your data is only accessible by you — enforced at the database level.
HTTPS Everywhere
All data in transit is protected by TLS encryption.
PCI Compliant Payments
Card data handled entirely by Stripe. We never store payment information.
Data Encryption
All data stored on LaborProof is encrypted at rest using industry-standard AES-256 encryption.
All data transmitted between your browser and our servers is protected by TLS (Transport Layer Security) encryption — the same standard used by banks and financial institutions.
This includes:
- Subcontractor profiles and contact information
- Insurance documents and certificates of insurance
- Expiration dates and compliance records
- Account credentials and personal information
Your data is never transmitted or stored without encryption.
Secure Document Storage
Insurance documents uploaded to LaborProof — including COIs, Workers Compensation certificates, General Liability policies, and Additional Insured Endorsements — are stored in private encrypted cloud storage powered by Supabase.
Documents are never publicly accessible. Every document is stored in a private bucket and can only be accessed via time-limited signed URLs that expire after a short window.
This means even if someone had the URL to a document it would stop working within minutes — protecting your subcontractors' sensitive insurance information at all times.
File size limit per upload: 15MB. Accepted formats: PDF, JPG, PNG.
Access Control and Row-Level Security
LaborProof enforces row-level security (RLS) at the database level on every single table.
This means your data is cryptographically scoped to your account. Even if another user somehow obtained a valid session token, they cannot access your subcontractors, your documents, or any data associated with your account.
What this means in practice:
- Your subcontractor list is only visible to you
- Your uploaded documents are only accessible from your account
- Your compliance data is private to your organization
- No LaborProof staff can access your data without your explicit permission for support purposes
Subcontractors who upload documents via magic link can only access their own upload page — they cannot see your dashboard, other subcontractors, or any other account information.
Authentication and Account Security
LaborProof uses Supabase Auth for all authentication — a battle-tested authentication system used by thousands of production applications worldwide.
Your account is protected by:
- Passwords are hashed using bcrypt — never stored in plain text anywhere in our system
- HIBP (Have I Been Pwned) password checking is enabled — we prevent the use of known compromised passwords at signup
- Google OAuth sign-in available as a secure alternative to email and password
- Session tokens are rotated automatically and expire after inactivity
- Magic link upload tokens are unique per subcontractor, cryptographically generated, and expire after 30 days
To keep your account secure we recommend:
- Using a strong unique password not used on other platforms
- Enabling Google sign-in for additional security
- Contacting support@laborproof.com immediately if you suspect unauthorized access
Payment Security
LaborProof never stores, processes, or transmits your credit or debit card information directly.
All payment processing is handled exclusively by Stripe — one of the world's most trusted payment infrastructure providers used by millions of businesses globally.
Stripe is certified to PCI Service Provider Level 1 — the highest level of certification available in the payments industry.
What this means for you:
- Your card number is never visible to LaborProof systems
- Your card data is tokenized by Stripe before transmission
- We only store a Stripe customer ID and subscription status — never raw card data
- All billing disputes and refund requests are handled through Stripe's secure portal
For billing questions contact support@laborproof.com.
Infrastructure and Third Party Security
LaborProof is built on trusted, enterprise-grade infrastructure:
Supabase
Database, authentication, and file storage infrastructure. Supabase is SOC 2 Type II compliant and runs on AWS infrastructure with multiple availability zones for reliability and data redundancy.
Stripe
Payment processing and subscription management. PCI DSS Level 1 certified. The most trusted payment infrastructure in the world.
Cloudflare
DNS management, DDoS protection, and network security. All traffic to laborproof.com passes through Cloudflare's global security network before reaching our servers.
Lovable Cloud
Application hosting and edge functions. Serverless architecture with automatic scaling and no single point of failure.
None of our infrastructure providers have access to your business data beyond what is necessary to operate their respective services.
Data Retention and Your Right to Delete
We only keep your data as long as you need us to.
Active accounts:
All data retained while your account is active and your subscription is current.
Cancelled accounts:
Your data is held securely for 90 days after cancellation. This gives you the opportunity to reactivate and pick up exactly where you left off. After 90 days all data is permanently and irreversibly deleted.
You will receive a warning email at day 75 before permanent deletion occurs so you have a final chance to reactivate or export your data.
Reminder logs:
Stored for 12 months for deduplication purposes then deleted.
Request deletion anytime:
You may request immediate permanent deletion of your account and all associated data at any time by contacting support@laborproof.com. We will process deletion requests within 10 business days.
Found a Security Issue?
We take security reports seriously and respond to all reports promptly.
If you believe you have discovered a security vulnerability in LaborProof please contact us immediately at:
Please include in your report:
- A description of the vulnerability
- Steps to reproduce the issue
- The potential impact you believe it could have
- Your contact information
We will acknowledge your report within 24 hours and keep you updated as we investigate and resolve the issue.
We ask that you do not publicly disclose any security vulnerabilities until we have had a reasonable opportunity to address them.
We appreciate responsible disclosure and take every report seriously regardless of severity.
For more information see our Privacy Policy and Terms of Service.
Security questions? Contact us at support@laborproof.com