Security and data

How we keep your jobs and customers safe.

What we store, where it lives, who can see it and how you get it back out.

Updated October 2026

Where your data lives

Cloudflare runs AreaMap Business. The app runs on Cloudflare Workers, your jobs, customers and proposals are in a Cloudflare D1 database, and logos, photos and files are in Cloudflare R2.
We don't run our own servers. Cloudflare holds SOC 2 Type II and ISO 27001 certifications.
Crew phones keep a copy of the jobs you send them, in the AreaMap iPhone app.

Encryption

Your browser talks to AreaMap Business over HTTPS, so what you send is encrypted on the way.
Cloudflare encrypts the database and stored files at rest.
Login cookies are signed and marked HttpOnly and Secure, so page scripts can't read them and they only travel over HTTPS.

Signing in

No passwords to steal or reuse. You log in with a link we email you. It works once, for 20 minutes.
We store only a one-way hash of each link, never the link itself.
Too many tries from one place are blocked for a while.

Who can see what

Every office request is checked against your company. One company can never read another's jobs, customers or prices.
Three roles: the owner, admins and estimators. Estimators can't change settings or prices. Only the owner changes the plan and billing.
Every change from the office carries a token tied to the person's login, and requests from other websites are refused.
Billing, plan, settings, crew and office user changes are written to an audit log.

Payments

Cards are entered on Stripe's own checkout and invoice pages. Card numbers never reach our servers.
Stripe is certified PCI DSS Level 1, the highest level for card payments.
Enterprise can also pay by invoice, online on Stripe's invoice page.

Backups

Cloudflare D1 keeps a point-in-time history of the database, so we can restore it to any minute within its retention window.
Files are stored by their content hash, so a file is never overwritten by mistake.
Jobs sent to the crew are also on their phones.

Privacy

We don't sell your data or your customers' data, and we don't take a cut of your jobs.
On your public quote page and forms we keep a scrambled hash of the visitor's network address to stop abuse, never the address itself.
Signed proposals keep the signer's name, the date and time, and the option they picked.

Export or delete your data

You own it. Export customers and jobs to CSV from the office on every plan.
The owner can delete the company in Settings. The plan stops at once and we delete the data within two business days.
Privacy policy and terms cover the rest.

Questions or a security issue?

Write to hq@velocityappdevelopment.com. A person reads every email and replies within one business day. If you think you've found a weakness, tell us there first and we'll fix it fast.

Email us