OneTool

This page describes how OneTool actually protects your data: the security measures built into the application, and the infrastructure providers we rely on. We believe in describing our security honestly — what we do ourselves, what our providers do, and where responsibility sits with you.

Infrastructure

OneTool is built on managed cloud infrastructure rather than servers we operate ourselves. Our providers maintain their own independent security programs and certifications:

Vercel hosts the web application and serves all traffic over HTTPS.
Convex provides our database and file storage, with encryption at rest and automated backups managed by Convex.
Clerk handles authentication — OneTool never stores or sees your password.
Stripe, a PCI DSS Level 1 certified payment processor, handles all card and bank data. Full card numbers and bank credentials never touch OneTool's systems.

OneTool itself does not currently hold certifications such as SOC 2 or ISO 27001. Where our providers hold certifications, those apply to their services, not to OneTool as a whole.

Encryption

In Transit: All traffic between your browser or mobile device and OneTool is encrypted with HTTPS/TLS.
At Rest: Data stored in our database and file storage is encrypted at rest by Convex, our infrastructure provider.
Payment Data: Card and bank details are encrypted and held by Stripe; OneTool stores only card brand and last four digits, and bank name and last four digits for payout accounts.
Portal Verification Codes: The one-time codes used for client portal sign-in are stored only as salted hashes, never in plain text.

Authentication & Access Control

Sign-In: Authentication is handled by Clerk, including OAuth sign-in options. OneTool never stores passwords.
Role-Based Access: Admins and members have different capabilities, with granular per-member permissions controlling access to areas of the Service.
Organization Isolation:Every backend function verifies the caller's organization and scopes all reads and writes to it. Users cannot access another organization's data.
Client Portal: Your clients sign in to their portal with a one-time email code. Portal sessions are short-lived, tracked server-side, and can be revoked — a stolen token alone is not enough to keep a session alive.
Rate Limiting: Sensitive operations — portal sign-in codes, quote approvals, payment initiation, and public form submissions — are rate limited to slow abuse and brute-force attempts.

Backups & Data Deletion

Backups: Database backups are managed by Convex as part of its platform. We recommend you also keep your own copies of critical business documents.
Deletion:When you delete your organization or account, an automated cascade permanently removes your organization's records — clients, contacts, quotes, invoices, emails, documents — and deletes the underlying files (attachments, PDFs, signatures) from storage.
Orphan Sweep: A daily automated job checks for and removes any data left behind by incomplete deletions.
Provider Data: Data already held by our service providers (for example Stripe transaction records or signed documents in BoldSign) is retained under their policies; contact us if you need help requesting deletion from a provider.

Multi-Tenant Data Isolation

OneTool is multi-tenant: many businesses share the same infrastructure, isolated at the application layer.

Enforced Scoping: Every database query and mutation is filtered by organization ID. This is a hard requirement of our backend architecture, not a convention.
Deny by Default: Requests without a valid authenticated organization context are rejected.
Operational Access: Access to production data is limited to what is necessary to operate the Service and provide support.

Application Security Practices

Webhook Verification: Every inbound webhook (Clerk, Stripe, Resend, BoldSign) is cryptographically verified before processing; unverified requests are rejected.
Content Sanitization: Inbound email HTML is sanitized before rendering to protect against injected scripts.
Signature Audit Trail: Quote approvals are recorded append-only with the signed content snapshot, signer identity, IP address, and timestamp, so approval records cannot be silently altered.
Dependency Updates: We keep dependencies updated and apply security patches as they become available.

Service Providers

The full list of third-party providers we use, and what data each receives, is in our Privacy Policy. In summary: Clerk (authentication), Convex (database and storage), Vercel (hosting), Stripe (payments), Resend (email), BoldSign (e-signatures), PostHog (web analytics), OpenAI (AI features), Mapbox (address search), and Expo (mobile services).

Vulnerability Disclosure

We appreciate responsible security research. If you find a vulnerability:

Report it to support@onetool.biz with enough detail to reproduce it.
Do not access or modify data that does not belong to you, and do not disrupt the Service.
We will not pursue legal action against researchers acting in good faith within these guidelines.
We will acknowledge your report, prioritize a fix based on severity, and coordinate disclosure with you.

Security Incidents

If we become aware of a security incident affecting your data, we will investigate promptly, take steps to contain and remediate it, and notify affected customers without undue delay, consistent with applicable law. We will be transparent about what happened and what we are doing about it.

Your Security Responsibilities

Use a strong, unique password for your account
Keep your login credentials confidential
Review who has access to your organization and remove members who no longer need it
Report suspicious activity immediately to support@onetool.biz
Keep your devices and browsers up to date
Be cautious of phishing; verify URLs before entering credentials
Keep your own copies of critical business documents and records

Questions or Concerns?

If you have questions about our security practices or want to report a security concern: