Security

Last updated September 22, 2026

Requesting solar quotes means handing over your address, your contact details, and often a copy of your utility bill. That is a real amount of information about your household, and this page explains what we do with it and how to tell us if you find something wrong.

Reporting a vulnerability

If you believe you have found a security issue, email noah@solarconnect.solar with enough detail to reproduce it. We aim to acknowledge within three business days.

Good-faith research is welcome. We will not pursue legal action against you for testing that follows this policy: do not access, modify, or delete data belonging to anyone else, do not degrade the service for other people, do not run automated scanning that generates meaningful load, and give us a reasonable window to fix the issue before publishing it.

We do not currently run a paid bug bounty. We will credit you publicly if you would like us to.

How your information is protected

Encryption in transit. The site is HTTPS only, with HSTS, so browsers refuse to connect over plain HTTP.
Access control at the database. Every table enforces row-level security. Staff access is checked against a verified session token on each request, not inferred in the browser.
Uploaded bills are private. They are stored in a private bucket, readable only by the customer they belong to and by our staff, and served through short-lived signed links rather than public URLs.
Installers do not receive your contact details as a lead to be called. Communication runs through Solar Connect.
Pinned third-party code. Every external script we load is pinned to a specific version and verified against a cryptographic hash, so a compromised content delivery network cannot silently swap it.
Browser hardening headers are set on every response, including a strict referrer policy, framing protection, and MIME-type protections.

What we are still working on

Publishing a list of controls without admitting the gaps would be marketing rather than a security page. Work currently in progress includes a Content Security Policy (in monitoring before enforcement), multi-factor authentication for staff accounts, and an internal audit trail of administrative actions.

Your data

To ask what we hold about you, correct it, or have it deleted, email noah@solarconnect.solar. See our Privacy Policy for details on what we collect and why.