Last updated: October 26, 2026
Operator: DusterBook
Contact: hello@dusterbook.com (subject “Security” for incidents)
This page explains, in plain language, how we help keep your DusterBook account and client records safe. It is an overview—not a warranty or certification.
Sign-in and passwords
You can sign in with email and password or, when enabled, Google sign-in. Passwords are stored using industry-standard one-way hashing (not plain text). Sessions use secure cookies in production.
Password reset and email verification need outbound email to be set up on the server that hosts your workspace. If email is not configured, those messages cannot be delivered.
Who can see what
Your data lives in a workspace shared only with people you invite. Owners, managers, and cleaners see different screens based on their role. Cleaners on Team plans typically see only jobs assigned to them.
Quote, invoice, and booking links you send to clients are meant to be shared with that client only. They use long random codes so strangers cannot guess them. Treat those links like you would a private document with names and addresses on it.
How the service is run
DusterBook runs as a modern web application with a PostgreSQL database. Many teams host it with Docker and a small background worker for scheduled tasks. Business logos you upload are stored as image files on controlled storage.
Use HTTPS in production so sign-in and client data travel encrypted. Match your public website address to what you configured when you deployed.
We do not offer a SOC 2 report today. Enterprise customers may contact us about security questionnaires.
Protecting data day to day
- Database access uses least-privilege credentials in production
- Secrets stay in server environment configuration—not in source code
- We keep dependencies updated through the project lockfile
- Hosting providers can use a simple health check URL for uptime monitoring
If you self-host, you are responsible for database backups and restore drills. Managed hosting should follow your provider’s backup policy.
Transactional email (verification, password reset, quote and invoice notifications when you turn them on) goes through the mail provider you configure. Rotate keys if they are ever exposed. Never put passwords or secrets in email bodies.
Your DusterBook subscription payments
Subscription charges are handled by Polar; we do not store your card number on DusterBook servers. Update your payment method from the billing portal linked in the app.
Abuse and overload
When Redis is available, we may slow down repeated failed sign-in attempts or spam submissions. Contact forms should also be protected at your hosting edge when possible.
Uploaded files
Upload logos and similar images only—do not upload executable files. Operators may add extra browser security headers at the reverse proxy.
Reporting a problem
Email hello@dusterbook.com with subject “Security”. Include steps to reproduce and what you think could happen. We appreciate responsible disclosure.
Please only test against workspaces you own or have permission to test.
Account recovery and deletion
You can export account data and delete accounts from settings. Workspace deletion may need owner confirmation. See our privacy policy.
If something goes wrong
If we confirm a breach affecting personal data, we will notify affected account holders and regulators as required by law, and post an update when appropriate.
Your part
- Use a strong unique password or Google sign-in with two-factor authentication on Google
- Limit owner access to people you trust
- Treat quote and invoice links as confidential when they show personal information
- Keep your deployment updated and restrict who can change server secrets
Limits
No online service is perfectly secure. See terms of service for liability limits.