Security

Less than you might expect. Seeing your disposal options and checking a quote need a postal code prefix and an item, and neither is tied to you. An email address is asked for only when you want firm quotes, and that request, the job description and any photos go only to the companies you picked. Haulers who list with us have an account, a company record, published price lists and verification evidence. The privacy policy says what is kept and for how long; this page is about how it is kept.

• No passwords. Sign-in is a one-time link sent to your email. It expires after fifteen minutes and works once. The link itself is never stored: only a hash of it is, so a copy of the database does not contain a working sign-in for anyone.
• Using the link is done inside a database transaction, so the same link opened in two tabs at once cannot sign in twice. After it is used you are redirected straight away so the link leaves the address bar and browser history.
• The sign-in page gives the same answer whether or not an address is on file, so it cannot be used to find out who has an account.
• The session is a signed token in a cookie marked HttpOnly, Secure and SameSite=Lax, valid for thirty days. On every request it is checked against the account record, so a deleted account or a revoked session stops working immediately rather than when the cookie expires.
• Every portal and admin page authorises on the server against the record being touched. A company can only act on its own checks and listings; nothing trusts an identifier sent by a browser. Where you are sent after sign-in is restricted to this site, so a crafted link cannot bounce you elsewhere.
• The app refuses to start at all if its signing secret is missing or too short, rather than falling back to a default.

Anything that makes us send an email to a third party is limited, because otherwise a stranger could use us to flood someone’s inbox. The limits are counted in the database, so they survive a restart and apply across servers. Sign-in links: five per network address every fifteen minutes and five per email address every hour. Quote requests: ten per hour. Data export and deletion requests: five per hour. The counters store only a hash of the address, never the address itself.

• Verification documents a hauler uploads are recorded with a checksum and are not served by any public route. There is no page on which a customer can see them.
• A quote room link is a random reference, and knowing it is what grants access. Those pages, along with the portal, admin and sign-in routes, are sent with headers telling search engines not to index them and shared caches not to store them, and the referrer policy stops the path leaking to other sites you click through to.
• Analytics events are scrubbed before they are written: anything that looks like an email, a phone number, a full postal code or a street address is replaced with a marker, and fields named for a person are dropped outright. An analytics failure never blocks a customer’s request.
• Deletion deletes. When you delete your data from the your data page, your quote requests, quotes, photos, outcomes, consent records, sign-in tokens, sessions and account are removed in one transaction, and the only record kept is a count of what was removed.
• The database is backed up once a day. The backup script checks that the dump is complete before it prunes anything, keeps thirty days of snapshots, and fails loudly if it cannot produce a good one. The release checklist refuses to pass if no recent backup exists.
• Administrative actions, sign-ins and deletions are written to an audit log. No screen in the product edits or removes those entries.

• HTTPS everywhere, with a strict transport security header of two years including subdomains, and certificates renewed automatically.
• A content security policy is sent on every page with a per-request nonce, so a script only runs if the page itself issued it. Scripts, connections, fonts and form submissions are restricted to this site, plugins are blocked, and the page may not be embedded in a frame on any other site.
• Further headers stop content-type sniffing, restrict the referrer to the origin, switch off features the site does not use such as payment and USB access, and isolate the browsing context from cross-origin windows.
• The constraints that matter, such as the cap of three companies a quote request can go to, are enforced by database constraints rather than only by the page, so a bug in the app cannot quietly break them.
• A health endpoint that checks the database is polled every ten minutes from outside the app, so an outage is noticed rather than reported by a customer.

We do not hold SOC 2, ISO 27001 or any other security certification, and we have not had an external penetration test. We do not process card payments on this site. If any of that changes, this page will say so with a date.

Email security@helpmedump.com. Tell us what you found and how to reproduce it. In return:

• We acknowledge within two working days and tell you what we think.
• We will not threaten you with legal action for a good-faith report.
• We fix genuine issues and tell you when they are fixed.
• We will credit you publicly if you want that, and not if you do not.

Please do not run automated scans against production, access anybody else’s data, or degrade the service for other people while testing.