Security and data, described plainly.

Accounts

You sign in with your email and password, or with "Continue with Google". Passwords are stored only as one-way bcrypt hashes, so nobody (including us) can read them. Your session is kept in your browser until you sign out or it expires. Password resets are sent by email from noreply@offeringstack.com.

Payments

Card details are entered into Square’s own payment form and go straight to Square; they never reach our servers. We keep the payment status and Square reference numbers. Every payment request carries a unique key so a retry can’t charge you twice, and payment notifications from Square are checked against Square’s signature before we act on them.

Checks on our servers

Whether you can download a clean PDF is decided on our servers, not in your browser. The free preview is watermarked into the page images on the server, so there is no overlay to remove.

Your files

• Uploaded images and generated PDFs are stored on our hosting provider’s storage at long, hard-to-guess web addresses. Anyone with the exact address can open a file, so share links with care.
• For each listing we keep the most recent 20 PDFs; older ones are deleted automatically.
• Deleting a listing deletes its stored PDFs.

Data sent to other services

To build your documents, some data leaves our platform: content you choose to process with AI features goes to AI model providers; property addresses and coordinates go to Mapbox, OpenStreetMap services and, for research, web search. Our Privacy Policy lists every service provider.

In transit

Connections to the website, the app and its services use HTTPS.

What we don’t claim

We don’t currently claim any third-party security certification. If your organization needs specific assurances, contact us before uploading confidential material.

Report a security issue

Call (519) 400-4667 or email hello@offeringstack.com. Please give us reasonable time to fix an issue before disclosing it.