Security

Here is what we concretely do to protect your data, money and conversations, and what you can do. No big words: only measures that exist.

What the platform does for you

Account and password

  • Passwords are stored only as a strong hash (bcrypt/Argon2 via PHP's standard function). Not even we can see them.
  • New passwords require at least 10 characters with letters and digits.
  • After several wrong attempts, login is temporarily locked to stop password guessing.
  • Client phone numbers are verified once with an SMS code.
  • Sessions use secure cookies protected from page scripts (HttpOnly) and from forged requests from other sites (SameSite). If an account is suspended, its session ends within a minute.
  • Mobile app tokens are stored only as hashes.

Contact and privacy

  • A client's phone and name are never shown on public pages. Only the professional who unlocks the request sees them, inside their account.
  • Phone numbers, emails and links are automatically filtered from request descriptions.
  • Every user can download all their data and delete their account from the "Privacy" page.
  • We collect only the data needed and do not sell it to third parties.

Payments

  • Card payments are handled by Stripe. Card details never pass through our servers.
  • Credits are added only after Stripe confirms the payment with a signed, verified notification (not from what the browser sends). Each notification is processed only once.
  • Credit operations (unlock, refund, admin change) run inside database transactions, so a double click or two simultaneous requests cannot spend or refund twice.

Technical security

  • All traffic uses HTTPS. We apply browser security headers, including a Content-Security-Policy that blocks unknown scripts.
  • Every form has CSRF protection. Database queries use parameterised statements (against SQL injection) and all user text is escaped on display (against XSS).
  • Uploaded photos are re-encoded on our server: hidden metadata (such as GPS location) is removed and format and size are checked.
  • Login, registration, contact and payment forms are rate limited to curb abuse.
  • Technical errors are logged for the team without exposing details to the user. The database is backed up.

Moderation

  • Every request and every professional is manually reviewed before being published.
  • Any request, user, review or message can be reported; the team reviews reports.

What you can do

  • Use a unique password you do not use elsewhere. We never ask for your password by email, SMS or phone.
  • Never give your SMS code to anyone.
  • Check that the address in your browser is exactly the platform's before logging in.
  • Before a big job: get a written quote, ask about warranty, look at previous work and do not pay everything upfront.
  • Pay for the work only after a clear agreement. The platform does not take payment for the work.
  • If someone asks you to leave the platform to pay elsewhere, or seems suspicious, report them.

What we cannot promise

No system is 100% unbreakable and we do not claim certifications we do not hold. We do not guarantee the quality of professionals' work: we verify the business and moderate, but the agreement and the work are between you and the professional.

Report a security issue

If you believe you found a vulnerability, write to info@preventivpro.com with details, without exploiting or sharing it publicly, and we will review it with priority. See also security.txt.