Security & Compliance
Last Updated: August 20, 2026 · Bank-Grade Protection for Contractors & Homeowners
Stripe PCI-DSS Level 1
All payment card data is processed via Stripe’s certified PCI Service Provider Level 1 infrastructure. Zero plain-text card numbers touch our servers.
256-Bit TLS Encryption
All data transmitted between mobile devices, contractor browsers, and customer invoice portals is encrypted using TLS 1.3 / 256-bit SSL certificates.
Cryptographically Signed Links
Estimates, invoices, and feedback forms are generated using tamper-proof secure tokens (/i/[token]), ensuring customers only view their exact job portal.
Cloudflare Enterprise DDoS Shield
Global Anycast network protection, automated rate-limiting, and Web Application Firewall (WAF) to prevent brute-force and DDoS attacks.
Infrastructure & Data Protection
OnderVolk is engineered from the ground up to protect confidential pricing books, homeowner addresses, and payment transaction logs. Our cloud infrastructure leverages multi-zone redundancy, encrypted automated backups, and strict role-based access control (RBAC).
Responsible Vulnerability Disclosure
We welcome security researchers and ethical hackers to audit our public surfaces. If you discover a potential vulnerability, please report it directly to security@ondervolk.com with detailed replication steps. We commit to acknowledging receipt within 24 hours and resolving critical security disclosures promptly.