Security & Trust

We don't hold any formal security certifications yet, and we'd rather say that plainly than imply otherwise. What follows is a straightforward account of how we actually run things — not a compliance checklist.

Data isolation

On Adcoar Tours and Adcoar Reach, every tenant gets its own isolated database rather than a shared table filtered by a tenant ID. That's a deliberate architectural choice, not a policy promise — a missing filter in a shared-table system is a data leak waiting to happen; in an isolated-database system, that category of bug is structurally impossible. We've written about why this matters in more detail.

Encryption in transit

All of our systems are served over HTTPS with certificates that renew automatically — there's no path to any of our platforms, or this site, that isn't encrypted end to end between your browser and our servers.

Backups

Production databases are backed up automatically every night, per tenant, with an offsite copy kept separately from the server itself. Backups are retained on a rolling window so a bad deploy or an operator mistake doesn't mean starting over from nothing.

Infrastructure

Our servers sit behind a firewall that only accepts traffic on the ports and from the sources it needs to, and automated tooling detects and blocks repeated unauthorized access attempts rather than relying on us to notice manually. Files uploaded to our platforms — rate sheets, stamped documents, campaign media — are scanned before they're processed.

Passwords and accounts

We never store passwords in plain text; they're hashed using the same industry-standard approach (bcrypt) used across the Laravel ecosystem our systems are built on. We'd never ask for your password over email, phone, or the contact form — if someone claiming to be us does, it isn't us.

Reporting a security issue

If you believe you've found a security vulnerability in any of our systems, we'd genuinely like to know before anyone else does. Please get in touch with details — we'll treat it seriously and won't take legal action against good-faith reports made to us privately and responsibly.