Security and trust
What we do with your information, who can see it, and the controls we run the shop's systems on.
Last updated: 6 September 2026
The five criteria and where we stand
- Security
- Only named people can reach customer records. Every account uses its own login, access is checked by role in the database itself, and privileged actions are written to an append-only log.
- Availability
- The site and database run on managed, replicated infrastructure with automated daily backups and point-in-time recovery.
- Processing integrity
- Every form is validated on the server before anything is stored, duplicate submissions are collapsed, and quotes are always confirmed in writing after inspection.
- Confidentiality
- Customer contact details are readable only by shop admins. Nothing on the public site can read a lead back out.
- Privacy
- We collect only what a quote or booking needs, say how long we keep it, and honour access and deletion requests.
Controls in place
- AC-1 Role based access
Admin rights live in a separate roles table and are checked by a database function. A role cannot be granted from the browser, so nobody can promote themselves.
- AC-2 Least privilege on every table
Row level security is on for all tables. Public visitors can submit an enquiry but can never read one back. Published content is the only thing readable without a login.
- AU-1 Append-only audit log
Admin sign-ins and privileged reads are written to an audit log with who, what, when, the address they came from, and the browser used. Only admins can read it; nobody can edit or delete entries from the app.
- SC-1 Transport and browser hardening
HTTPS everywhere with strict transport security, clickjacking protection, no MIME sniffing, a locked down referrer policy, and camera, microphone, and location switched off for the site.
- SI-1 Input validation and spam control
Every submission is validated on the server, bot traps and timing checks are in place, and repeat submissions are collapsed by a dedupe key.
- CM-1 Change management
Every code and database change is version controlled with a full history, type checked before release, and deployed through a preview environment first.
- PR-1 Consent and privacy by default
Nothing optional runs before consent. Analytics stays off until a visitor accepts, and text messages only go to people who ticked the box.
Who we share data with
The complete list of outside services that can touch customer information.
| Service | What it does | What it can see | Safeguards | Reviewed |
|---|---|---|---|---|
| Managed cloud hosting and database | Runs the website, stores enquiries, bookings, and shop content. | Name, phone, optional email, vehicle and job details. | Encryption in transit and at rest, row level security, daily backups. | Annual |
| Email provider (Google Workspace / Gmail) | Receives enquiry notifications and customer correspondence. | Anything a customer writes to the shop. | Provider security programme, two factor login required on shop accounts. | Annual |
| SMS provider | Sends appointment and status texts to customers who opted in. | Phone number, message content. | Consent recorded before first message, STOP honoured immediately. | Annual — [confirm provider name and contract] |
| Analytics | Counts page views and button clicks to improve the site. | Page paths and event names only. No names, no phone numbers. | Blocked entirely until a visitor accepts analytics cookies. | Annual |
How long we keep things
| Record | Kept for | Then |
|---|---|---|
| Enquiries and quotes that never became a job | [24 months] | Deleted |
| Customer and vehicle service records | [7 years] | Deleted |
| Text message consent records | Life of the record plus [4 years] | Deleted |
| Audit log of admin activity | [12 months] | Deleted |
| Cookie and accessibility choices | 12 months | Expires on the device |
What we check, and how often
| Check | Frequency |
|---|---|
| Review who has admin access and remove anyone who left | Quarterly |
| Confirm two factor login is on for every shop account | Quarterly |
| Review the audit log for anything unexpected | Monthly |
| Re-check the vendor list and their security posture | Annually |
| Test restoring a backup | Annually |
| Walk through the incident response plan | Annually |
If something goes wrong
- 1. Contain — Disable the affected account or take the affected page offline immediately.
- 2. Assess — Use the audit log to work out what was reached, by whom, and when.
- 3. Notify — Tell affected customers without unreasonable delay, and any regulator required by Florida law. Owner ([Randy Williams]) makes the call.
- 4. Fix — Close the hole, rotate credentials, and confirm the fix in the preview environment before release.
- 5. Record — Write up what happened, what changed, and what will stop it happening again.
Report a security concern to totalperformancetuning@gmail.com with "Security" in the subject, or call 352 973 5565. We aim to reply within two business days and we will not pursue anyone who reports a genuine issue in good faith.
What full SOC 2 still requires
- Written information security policy set — An auditor tests policies against practice. The practices exist; the signed documents do not. Owner: Owner, with a compliance advisor.
- Signed vendor agreements and security reviews — Each vendor above needs a current contract on file with its security terms. Owner: Owner.
- Employee onboarding, offboarding, and security training records — Auditors sample staff records; these are kept off the website. Owner: Owner.
- Type I or Type II examination by a licensed CPA firm — Only an accredited firm can issue a SOC 2 report. Type II also requires an observation window of 3 to 12 months. Owner: CPA / SOC 2 auditor.