TRUST CENTER
Security you can verify.
We do not claim certifications we haven't earned. This page is the honest picture: the controls we run today, the audits in-flight with Vanta, and where you can send a security question.
Certification Status
Updated as our program with Vanta advances. Nothing on this list is exaggerated.
Card handling is fully delegated to Stripe, which maintains Level 1 certification (the strictest PCI tier).
Formal audit preparation is underway with Vanta. We are working through evidence collection and expect to publish our first report during our next fiscal window.
Type II requires 6-12 months of continuous evidence after Type I. It is on our roadmap and will follow the Type I report.
On the roadmap after SOC 2 Type II. Prioritized alongside enterprise / cross-border demand.
Help and Handy is a home-services marketplace. We do not collect, store, or transmit Protected Health Information, so HIPAA is not applicable to our platform.
Automated compliance monitoring provided by Vanta. Progress reports available on request to enterprise / investor contacts.
Security Controls in Production Today
These controls are live in the platform right now — not planned, not marketing-speak. Each one is a real safeguard that runs on every request.
Every password is one-way hashed with bcrypt + per-user salt. Plaintext passwords never touch disk or logs.
HTTPS is enforced on every page and API endpoint. HTTP requests are redirected to HTTPS at the edge.
Every mutating request requires a double-submit CSRF token (secure cookie + matching X-CSRF-Token header). Missing tokens are 403.
Login, password reset, and the anonymous AI chat widget are all IP-throttled to block credential-stuffing and LLM cost-drain attacks.
Sessions are stored in HttpOnly cookies with SameSite=Lax, invisible to JavaScript and hardened against CSRF drift.
Card numbers go directly to Stripe Elements. Our backend only ever sees Stripe tokens — not card data. (Stripe is PCI-DSS Level 1 certified.)
Technicians, laborers, and partners complete identity + background verification before any customer job. Documents are encrypted at rest.
Every admin action — user delete, booking cancel, fee waiver, agreement signature — is stamped with actor, timestamp, and reason.
The AI assistant refuses and redacts messages containing credit-card numbers, SSNs, and other sensitive PII before they ever reach the LLM.
Every contractor signs a digital agreement (with signed PDF receipt) and completes W-9 collection. 1099-K reporting is handled per IRS 2024 rules.
Bios are scanned for R2 forbidden phrases (franchise, passive income, guaranteed earnings). Admin queue lets us clear violations in one tap.
Six explicit roles — customer, technician, laborer, manager, ASP, PDR, admin — each gated by server-side role checks on every request. No client-side trust.
Data Handling
- • All data is stored in the United States on hardened cloud infrastructure.
- • Backups are automated daily with a point-in-time recovery window.
- • Access to production data is limited to a small number of named engineers on a least-privilege basis, and every access is audit-logged.
- • Payment card data is never stored on our servers — Stripe handles it end-to-end.
- • Identity verification documents (ID, W-9) are encrypted at rest and accessible only to the compliance team.
- • Users can request deletion of their data at any time via the contact below or their account settings.
Request Full Security Overview
Investors, procurement teams, and enterprise buyers — leave a note and our team will follow up within one business day with our current control status, Vanta progress, and any custom documentation you need.
Report a Security Issue
Found a vulnerability? Please email us — we investigate every report and never take action against researchers who follow responsible-disclosure norms.
security@helpandhandy.comFor non-security questions, see our Privacy Policy or Terms of Service.