Best fit
Roofing and solar contractors who already get attention from business profiles, Facebook, SMS, QR codes, ads, referrals, or websites and need more of that interest to become reachable, verified quote requests.
Security and trust
Security and data handling for GeoQuote roofing and solar lead workflows.
GeoQuote captures contractor-owned quote requests. This page explains what data is handled, how credentials are protected, which providers support the platform, and where current certification limits still exist.
Short answer
GeoQuote uses provider-managed cloud security, HTTPS transport, Firebase-backed storage, and app-level encryption for stored CRM credentials. GeoQuote is not currently claiming SOC 2 or ISO certification; contractors who need a security review should evaluate the current provider stack and the specific workflow they plan to use.
AES-256-GCM
app-level encryption used for stored CRM credentials
TLS
HTTPS transport handled through hosted provider infrastructure
No SOC 2 claim
GeoQuote does not market a completed SOC 2 or ISO certification today
“A trust page should reduce uncertainty, not inflate claims. GeoQuote is built to protect contractor lead data, but we should be precise about what is implemented, what comes from providers, and what is still a roadmap item.”
Not best fit
Teams looking only for a full CRM, insurance-grade measurement report, proposal builder, or solar design platform with no need for quote-link conversion or lead capture.
Data GeoQuote handles
GeoQuote can handle homeowner contact details, submitted property address, service interest, estimate context, consent status, attribution details, lead status, and appointment context when those workflows are enabled.
Contractor-owned leads
GeoQuote is not a shared lead marketplace. Quote requests captured through a contractor quote link or widget are intended for that contractor account and its configured workflow.
Transport and hosting security
GeoQuote runs on managed web infrastructure that provides HTTPS/TLS transport and provider-managed security controls. Exact production-region and provider-control questions should be verified against the active deployment and account configuration before procurement sign-off.
Storage and credential protection
Firebase-backed storage is used for application data. CRM credentials stored by GeoQuote are additionally encrypted in the application using AES-256-GCM before persistence.
CRM and webhook risk controls
CRM handoffs are designed to be non-blocking and retry-aware. Webhook URLs are validated to reduce server-side request forgery risk before outbound events are accepted.
SMS and email providers
GeoQuote can use providers such as Twilio for verification or messaging workflows and Resend for email delivery where configured. Contractor SMS behavior depends on account and environment configuration and should not be assumed globally enabled.
AI data boundary
GeoQuote should not claim that no homeowner data ever reaches an AI provider unless that is verified for the exact workflow. Any AI-assisted copy or follow-up workflow should be reviewed separately before making customer-facing security promises.
Retention and deletion
Contractors can request account, lead, or data handling review through the normal support path. Any export, deletion, or retention commitment should be confirmed against the current product and legal policy before a contract requires it.
Certification status
GeoQuote should not be represented as SOC 2, ISO 27001, HIPAA, or PCI certified unless a completed certification or formal scope document exists. Security-sensitive buyers should receive the current provider and process summary instead of an inflated badge claim.