Security
RoofCalc is a young product. This page lists the safeguards that are in the code today and the ones that are not in place yet, so you can decide what to trust it with.
Accounts sign in with email and password through better-auth, an open-source sign-in library. Each sign-in creates a session stored in our database with an expiry date, 7 days by default, and an expired session is refused. Session cookies are only sent over HTTPS.
Passwords are stored only as salted scrypt hashes, the better-auth default, never as the password itself. Nobody at RoofCalc can see your password.
Measurements and your saved job rates are tied to your user account. When the app asks for them, the request is checked against your session and only your own records come back.
Account and measurement data is kept in a PostgreSQL database, reached through the Prisma ORM. Prisma sends the values you type separately from the query itself, which blocks the usual SQL injection tricks.
Paid plans will use Stripe Checkout and Stripe's billing portal, so card numbers go to Stripe and never reach RoofCalc's servers. Messages from Stripe are checked against a signing secret before we act on them. Billing is not open yet, and the code refuses to start a live charge until it is.
The site and its API run on Vercel over HTTPS. The API's cross-origin rules grant credentialed access only to RoofCalc's own web addresses and local development addresses, and the API throttles repeated requests from the same IP address.
The database already models a company as an organization with members, each with an owner, admin or member role, so access can be scoped per company.
Coming soon Team workspaces, invites and seats are not open yet.
If your company needs any of these before it can use RoofCalc, tell us. It helps us decide what to build first.
Email hello@harmonyaitechnologies.com with what you found and the steps to reproduce it. Please test only against your own account, do not access other people's data, and give us a fair chance to fix the problem before you tell anyone else.
There is no bug bounty program.
The privacy policy lists what RoofCalc stores, the outside services an address is sent to when you measure it, and who handles payments and hosting.
Last reviewed against the code on 2026-09-23.