Priceguide Security Overview

Priceguide Ltd Version: 1.1 Last updated: 26 April 2026 Audience: Customers, prospects, security and procurement teams

1. Introduction

Priceguide is an AI-powered pricing estimator platform used by home service contractors to provide instant price ranges to homeowners on their websites. Customers — typically franchise brands, multi-location service businesses, and independent contractors — embed Priceguide on their site, configure their pricing model, and receive qualified leads.

This Security Overview describes the technical and organisational measures we use to protect customer and end-user data. It is intended to support security review, vendor due diligence, and DPA negotiations. A pre-completed CSA CAIQ-Lite questionnaire is also available on request.

For specific questions, please contact [email protected].

2. Company and platform at a glance

3. Security governance

3.1 Ownership

Security at Priceguide is owned at the executive level by the co-founders. Day-to-day security operations are run jointly by Priceguide and our development partner SpinUp Ltd, who are bound to equivalent security and confidentiality obligations through their contractual relationship with Priceguide. We are intentionally a small organisation; security responsibilities are explicitly assigned rather than implied.

3.2 Policies

We maintain a documented set of policies covering:

• Information security
• Access control
• Data classification, retention, and deletion
• Incident response
• Vendor and Sub-processor management
• Secure software development

Policies are reviewed annually.

3.3 Risk management

We maintain a risk register covering platform, vendor, regulatory, and operational risks. Risks are reviewed by the co-founders quarterly, and high-impact risks are tracked to remediation.

3.4 Personnel

Personnel with access to production systems (Priceguide founders and SpinUp engineers):

• are bound by written confidentiality obligations through their contractual relationship with Priceguide;
• have undergone identity verification and role-appropriate reference checks prior to being granted production access;
• complete security and privacy awareness orientation, with refreshers as appropriate;
• have access provisioned on a least-privilege basis; and
• have access revoked promptly on departure or contract end.

4. Architecture overview

                         ┌──────────────────────┐
                         │   Cloudflare Edge    │
                         │  WAF · DDoS · CDN    │
                         └──────────┬───────────┘
                                    │
                                    ▼
                         ┌──────────────────────┐
                         │   Vercel Platform    │
                         │ (App + API + Edge    │
                         │  functions, AWS-     │
                         │  backed underneath)  │
                         └──────────┬───────────┘
                                    │
       ┌────────────────────────────┼────────────────────────────┐
       ▼                            ▼                            ▼
┌────────────────┐          ┌──────────────┐           ┌────────────────┐
│   Database     │          │    Auth0     │           │   Sub-services │
│  (encrypted    │          │ Identity/MFA │           │  OpenAI, Send- │
│   at rest)     │          │              │           │  Grid, Stripe, │
└────────────────┘          └──────────────┘           │  Airtable      │
                                                       └────────────────┘

The platform is fully cloud-hosted. Priceguide does not operate physical data centre infrastructure. End-user traffic terminates at Cloudflare, then passes through Vercel’s edge and serverless layer to back-end services.

5. Data protection

5.1 Data classification

5.2 Encryption

• In transit: TLS 1.2 minimum; TLS 1.3 supported. HSTS enabled on customer-facing endpoints; strict transport security headers in use.
• At rest: AES-256 (or provider equivalent) on databases, object storage, and backups managed by Vercel and AWS.
• Secrets: environment variables stored in Vercel’s encrypted secrets store; not committed to source control.

5.3 Data minimisation

Estimators are designed to collect only the information needed to generate a price and route a lead. We do not collect government identifiers, payment information from end users, health data, or other sensitive categories.

When invoking AI/LLM providers (currently OpenAI), we do not send personally identifying fields (name, email, telephone, full address). Only the question and answer content needed for the AI task is sent.

5.4 Backups

• Automated database backups with point-in-time recovery.
• Backup retention up to thirty-five (35) days.
• Backups are encrypted at rest with the same standard as production data.

5.5 Retention and deletion

• Estimator submissions: default 24 months from submission, configurable downward by the customer.
• Customer account data: retained for the contract term plus 6 years (UK statutory limitation period).
• Backups: rotated out within 35 days.
• Operational and security logs: retained per hosting provider defaults (typically up to 12 months).
• Deletion on request: customers may request deletion via the product or by emailing [email protected]. Verified deletion is completed within 90 days, except where law requires retention.

Further detail is in our Data Retention and Deletion Policy, available on request.

6. Application security

6.1 Secure development

• All code changes are reviewed by an engineer other than the author before merging.
• Static analysis runs on pull requests.
• Dependency scanning is in use; vulnerabilities are addressed on a risk-prioritised basis.
• Production deploys go through CI checks; deploys can be rolled back via Vercel’s deployment system.

6.2 Authentication and authorisation

• Customer authentication is via Auth0, which supports MFA and SSO (where the customer’s plan permits).
• Administrative access requires MFA.
• Session tokens are short-lived; refresh and rotation are managed by Auth0.
• Role-based access control inside the application limits actions to those appropriate to a user’s role within the customer organisation.

6.3 Web application protections

• Input validation and output encoding to defend against XSS and injection.
• Parameterised queries throughout.
• CSRF protection on state-changing endpoints.
• Cloudflare WAF in front of customer-facing endpoints.
• Bot management and rate limiting on form submission endpoints.

6.4 API security

• All APIs require authentication except publicly documented endpoints (e.g., the schema discovery endpoint).
• Per-customer rate limits.
• API tokens are scoped to specific customers and may be rotated by the customer at any time.

6.5 Vulnerability disclosure

A coordinated disclosure process is in place. Please report security issues to [email protected]. We will acknowledge reports within two business days.

7. Infrastructure security

7.1 Cloud providers

• Vercel — application hosting, serverless compute, edge network. SOC 2 Type II, ISO 27001.
• Cloudflare — DNS, CDN, WAF, DDoS mitigation. SOC 2 Type II, ISO 27001, PCI DSS.
• AWS (via Vercel) — underlying compute and storage. SOC 1/2/3, ISO 27001, ISO 27017, ISO 27018, PCI DSS.

We do not operate physical data centre infrastructure. Physical security is provided by these vendors, who maintain independently audited controls.

7.2 Network security

• All public ingress passes through Cloudflare and Vercel’s managed edge.
• No direct public internet exposure of databases or back-end services.
• Logical network segmentation between production, staging, and corporate environments.

7.3 Endpoint security

• Personnel devices used to access production are protected with full-disk encryption and screen lock.
• Production access requires MFA from approved devices.

8. Logging and monitoring

• Application logs captured for authentication events, administrative actions, error conditions, and security-relevant events. Retention follows hosting provider defaults (typically up to 12 months).
• Infrastructure logs captured by Vercel and Cloudflare per their standard retention.
• Audit logs of administrative actions are retained and reviewable on customer request for the customer’s own scope of data.

9. Incident response

We maintain a documented Incident Response Plan covering:

• Roles and responsibilities (incident commander, communications lead, technical lead).
• Severity classification (P1/P2/P3) with response and notification timelines.
• Escalation paths (Support → co-founders → SpinUp incident lead).
• External communication templates.
• Customer notification without undue delay and in any event within forty-eight (48) hours of confirming a Personal Data Breach affecting customer data.
• Post-incident review for P1/P2 incidents.

To report a suspected security incident, please email [email protected].

10. Vendor and Sub-processor management

We engage Sub-processors only after:

• reviewing their security posture (certifications, public security documentation);
• confirming written data protection terms (which may take the form of the Sub-processor’s published data processing addendum); and
• confirming appropriate transfer mechanisms for cross-border data flows.

The current Sub-processor list is published at priceguide.ai/sub-processor-list. Changes are notified at least thirty (30) days in advance.

11. Privacy and compliance

• UK GDPR / EU GDPR — primary regulatory framework. Records of Processing Activities maintained internally.
• CCPA/CPRA — addressed in our Privacy Policy and DPA. We act as a Service Provider under CCPA.
• DPO — Priceguide is not required to designate a Data Protection Officer under UK GDPR Article 37; privacy enquiries are handled by the co-founders. We review the need for a DPO as our processing scales.
• Data subject requests — supported via the product and via [email protected].
• Cookie consent — managed via cookie banner on priceguide.ai with granular consent for analytics and marketing categories (GA4, Meta Pixel, ActiveCampaign). The customer dashboard at app.priceguide.ai uses Hotjar for product analytics. The customer-facing estimator embed itself uses only strictly necessary cookies.

12. Business continuity

12.1 Resilience

The platform inherits the resilience of Vercel and Cloudflare, both of which operate globally distributed infrastructure with their own continuity programmes. Application code is stateless where possible; state lives in managed, replicated services.

12.2 Disaster recovery objectives

These targets cover data restoration from backup. Vendor-level outages outside our control are subject to the vendor’s own SLAs; we communicate during major incidents via the priceguide.ai status channel.

12.3 Vendor diversity and lock-in

We maintain export tooling that allows customers to retrieve their data in standard formats (CSV, JSON) at any time. In the event of a critical vendor change, customer data export remains the primary continuity mechanism.

13. Compliance posture

Priceguide is a young company. We are transparent about the state of our compliance programme.

In place today

• Documented privacy programme (Privacy Policy, DPA, Sub-processor List, Records of Processing Activities, Data Retention and Deletion Policy, Incident Response Plan).
• Encryption in transit and at rest.
• Multi-factor authentication for administrative access.
• Code review, static analysis, and dependency scanning in our development process.
• Logging and backup with point-in-time recovery.
• Pre-completed CAIQ-Lite security questionnaire available on request.

We do not currently hold SOC 2 or ISO 27001 certifications. Our hosting providers (Vercel, AWS, Cloudflare) hold these certifications, and we inherit the relevant infrastructure-level controls.

We are open to discussing custom security obligations with enterprise customers.

14. Contact

• Security questions and disclosures: [email protected]
• Privacy questions: [email protected]
• Procurement and legal: [email protected]

Priceguide Ltd 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom