DoorPrep is built for real shops running real business data. Here's how we keep it safe — in plain terms.
Every connection uses HTTPS/TLS, so data moving between your phones and our servers is encrypted in transit — no one on the network can read it. Stored data is encrypted at rest, including backups.
Owner/manager passwords are hashed with bcrypt (industry standard) — we literally can't see them. Shop-floor workers sign in with a private PIN.
DoorPrep is multi-tenant: every order, door, customer and invoice is scoped to your shop. One shop can never see or touch another's data.
Repeated failed sign-ins and PIN attempts are rate-limited and temporarily blocked, so accounts can't be brute-forced.
Logins use signed, Secure, SameSite cookies. Strict security headers (content-security-policy, clickjacking protection, HSTS) guard every page.
We don't load code from ad networks or trackers. Everything runs from our own servers — your data isn't handed to third parties.
Card payments are handled by Stripe, a PCI-DSS-certified processor. DoorPrep never sees or stores your card numbers.
Runs on secure cloud infrastructure with a managed database and daily backups, so your data is durable.
We welcome responsible disclosure. If you believe you've found a vulnerability, email security@doorprep.com and we'll respond quickly. Please give us a reasonable chance to fix it before disclosing publicly.
DoorPrep follows security best practices and keeps improving. This page describes how the product works today, not a formal certification — for specific compliance needs, get in touch.