# Security · HandledIQ

> How HandledIQ protects accounts and records.

Canonical: https://app.handlediq.com/legal/security
Last updated: 2026-10-26

## Security

Effective October 26, 2026. Version 2026-10-26. Operated by Ironclad Solutions LLC, a Puerto Rico company that operates HandledIQ.

How HandledIQ protects shops, their teams and their customers today. This describes what the product does, not a certification.

### Sign-in

- Passwords must be 15 characters or more, are checked against common passwords on our own computers, and are stored only as Argon2id hashes.
- Sign-in attempts are limited per network address. Sessions end after 12 hours, or 30 minutes without use, and end everywhere when a password changes.
- An installation can require a 6-digit code emailed at sign-in, which lasts 10 minutes and allows 5 tries.
- Sign-in cookies are HttpOnly, SameSite and HTTPS-only on the live site. Every change must come from HandledIQ’s own pages and carries a form-safety check.
- Owners decide who signs in and with what role. Technicians see only what their role allows.

### Keeping shops apart

- Every record belongs to one shop. The server finds the shop from the signed-in session, never from anything the browser says.
- Customer links (home records, estimates, payment pages) are long random addresses, are not indexed by search engines, and show only that customer’s records.

### Protecting data

- All traffic uses HTTPS. Keys for services a shop connects are encrypted with AES-256-GCM before they are stored.
- Card numbers are entered on Stripe’s pages and never reach HandledIQ.
- Backups are taken on a schedule, encrypted with AES-256 before they leave our computers, stored off-site, read back to check they arrived intact, and restored in practice runs to prove they work.
- HandledIQ’s own AI (Hoss, record search, and reading photos and paper) runs on computers we operate. During receptionist calls, Telnyx, the phone carrier, turns the caller’s speech into text. An AI app a shop’s owner connects reads only what the owner allows.
- Money never moves on a model’s word. A named person’s yes is recorded for each payment; texts go on their own only for the kinds the owner leaves on, and each one is recorded.
- Important records keep their history: corrections are added, not written over, so what happened can always be traced.

### What we don’t claim

HandledIQ does not currently hold SOC 2, ISO 27001, PCI DSS or HIPAA certifications, and is not meant for health or card data.

### Report a security problem

Email [hello@handlediq.com](mailto:hello@handlediq.com). Please give us a reasonable chance to fix a problem before sharing it, and don’t access other people’s data while testing. Our [security.txt](https://app.handlediq.com/.well-known/security.txt) lists the same contact.

### Related

- [Terms of Service](https://app.handlediq.com/legal/terms)
- [Privacy Policy](https://app.handlediq.com/legal/privacy)
- [Data Processing terms](https://app.handlediq.com/legal/data-processing)
- [Acceptable Use](https://app.handlediq.com/legal/acceptable-use)
- [Subprocessors](https://app.handlediq.com/legal/subprocessors)
- [Booking from an AI app](https://app.handlediq.com/legal/ai-booking)
- [Changes to these terms](https://app.handlediq.com/legal/changes)
- [Text message terms](https://app.handlediq.com/terms)