Security
What we actually do, and where we are not there yet
Specifics rather than badges. Where a control is required by HubSpot or Intuit rather than chosen by us, this page says so.
Credentials
| Neither connection uses a password | Both connections are OAuth: you authorise in HubSpot and in Intuit, and Handled receives tokens, never your HubSpot or Intuit password. An account on this website can have a password of its own, and it is stored only as a hash. |
|---|---|
| QuickBooks® tokens encrypted at rest | QuickBooks refresh tokens and the company identifier are encrypted with a key held separately from the database. Intuit requires this of every app touching production QuickBooks data. |
| HubSpot tokens: not yet | HubSpot tokens are not yet encrypted at rest. They are stored in plain text in our database, and encrypting them is a pre-launch item we have not finished. The privacy page names the same gap. |
| Never logged, never returned | Credentials are never written to logs, never returned by an API response, and never present in these pages, which are world-readable by definition. |
Request authentication
| Signed requests from the card | Every request from the Handled card and settings page must carry a valid HubSpot v3 signature, HMAC-SHA256 over method, full URL, body and timestamp. An unsigned request is rejected with 401. Verified, not aspirational. |
|---|---|
| Background endpoints | The scheduled endpoints are not user-facing and authenticate on a bearer secret rather than a HubSpot signature. We name that rather than implying one mechanism guards everything. |
| Webhook verification | QuickBooks webhooks are verified by HMAC before anything is queued. An invalid signature is rejected with 401. |
| Transport | All traffic is HTTPS. |
Money movement
| No payment rail | Handled does not process payments and never touches a payment rail. It reads what QuickBooks records. |
|---|---|
| Nothing posts unapproved | No invoice reaches QuickBooks without approval, either a person approving that specific draw or a standing automation rule, which is off by default. Any user in your HubSpot portal who can open the card can approve, post, void and send, and can switch that rule on: Handled does not check HubSpot roles or deal permissions. Approval is refused if the amount changed since it was displayed, and both figures are named in the refusal. |
Data separation and erasure
| Scoped to your portal | Every table holding your CRM or QuickBooks data is scoped to your HubSpot portal. A website account belongs to the person, not to a portal, because one person can hold access to several. |
|---|---|
| Erasure is a hard delete | Table by table, with a per-table report. Not a flag and not an archive. One record is kept: our billing record for your portal, which holds none of your CRM or QuickBooks data. The privacy page lists what is erased, and what that record holds. |
| You need not uninstall | You do not have to uninstall to have data erased. Ask us and we will run it and send you the report. |
This website
| No tracking of any kind | These pages are static. No analytics, no tracking pixels, no third-party scripts, no external fonts, so browsing this site sends your visit to nobody but the server that served it. |
|---|
Where we are on formal certification
We do not hold a SOC 2 report, an ISO certification or a third-party penetration-test result today. Handled is a new product and we would rather be straight with you than vague. They are on our roadmap and we are working towards them.
What we can offer in the meantime is specifics rather than a badge: the controls above are real, described accurately, and we are happy to walk your security team through any of them. Intuit also runs its own security review of apps operating at scale, and we will publish that outcome when there is one to publish.
If procurement needs something particular, a questionnaire, a data-flow diagram, a written answer about a specific control, just ask. We will give you a straight answer, including where the answer is “not yet”.
Reporting a vulnerability
Email security@roofingbusinesspartner.com. Tell us what you found and how to reproduce it. We will confirm receipt, keep you updated, and we will not take action against anyone who reports in good faith.