Security and trust
GeoQuote captures contractor-owned quote requests. This page explains what data is handled, how credentials are protected, which providers support the platform, and where current certification limits still exist.
GeoQuote uses provider-managed cloud security, HTTPS transport, Firebase-backed storage, and app-level encryption for stored CRM credentials. GeoQuote is not currently claiming SOC 2 or ISO certification; contractors who need a security review should evaluate the current provider stack and the specific workflow they plan to use.
AES-256-GCM
app-level encryption used for stored CRM credentials
TLS
HTTPS transport handled through hosted provider infrastructure
No SOC 2 claim
GeoQuote does not market a completed SOC 2 or ISO certification today
Roofing and solar contractors who already get attention from Google, Facebook, texts, QR codes, ads, referrals, or websites and want one branded quote page that collects the address, contact information, and job details before the first sales call.
Teams looking only for a full CRM, insurance-grade measurement report, proposal builder, or solar design platform with no need for quote-link conversion or lead capture.
GeoQuote can handle homeowner contact details, submitted property address, service interest, estimate context, consent status, attribution details, lead status, and appointment context when those workflows are enabled.
GeoQuote is not a shared lead marketplace. Quote requests captured through a contractor quote link or widget are intended for that contractor account and its configured workflow.
GeoQuote runs on managed web infrastructure that provides HTTPS/TLS transport and provider-managed security controls. Exact production-region and provider-control questions should be verified against the active deployment and account configuration before procurement sign-off.
Firebase-backed storage is used for application data. CRM credentials stored by GeoQuote are additionally encrypted in the application using AES-256-GCM before persistence.
CRM handoffs are designed to be non-blocking and retry-aware. Webhook URLs are validated to reduce server-side request forgery risk before outbound events are accepted.
GeoQuote can use providers such as Twilio for verification or messaging workflows and Resend for email delivery where configured. Contractor SMS behavior depends on account and environment configuration and should not be assumed globally enabled.
AI-assisted copy or follow-up may involve an AI provider depending on the enabled workflow. Contractors with data-boundary requirements should review the exact configured flow before activation.
Contractors can request account, lead, or data handling review through the normal support path. Any export, deletion, or retention commitment should be confirmed against the current product and legal policy before a contract requires it.
GeoQuote is not currently represented as SOC 2, ISO 27001, HIPAA, or PCI certified. Security-sensitive buyers can review the current provider and process summary instead of relying on an unsupported badge claim.
No current, scoped SOC 2 report is offered on this page. Evaluate GeoQuote using its implemented app controls and the controls supplied by its managed providers.
Yes. Stored CRM credentials are encrypted in the application using AES-256-GCM before they are persisted.
No. GeoQuote is designed for contractor-owned quote requests captured from the contractor website, quote link, ads, QR codes, SMS, referrals, or other owned channels.
No. SMS behavior depends on the configured account and environment. Email, webhook, CRM, and dashboard workflows should be evaluated separately from optional SMS notifications.
Yes. A contractor can review the active workflow, provider stack, credential handling, webhook behavior, privacy policy, and any contract-specific data requirements before rollout.
Do not assume a specific region from this page alone. Region claims should be verified against the active Vercel, Firebase, and storage configuration for the production deployment.