Security & data
What happens to your price books and quotes.
ReadyVariant is in customer preview. This page describes exactly how it works today, including what it does not do yet.
Where your data lives
Each workspace has its own database file and its own storage folder on a single server that ReadyVariant operates. Uploaded price books, schedules, catalogs, customers and quotes are only reachable through a signed-in session for that workspace. The website runs on Cloudflare, which forwards requests to the server over HTTPS with a private secret.
Accounts and sessions
Passwords are stored as salted scrypt hashes, never in plain text. Sign-in cookies are HttpOnly, Secure and SameSite=Strict, and expire after 12 hours. Email verification is required, and password resets revoke existing sessions. The owner invites estimators and viewers, each with their own sign-in; estimators cannot change price books, and quotes above an approval limit wait for the owner. SSO is not available yet.
Backups
Every night the databases are copied with SQLite’s online backup API and integrity-checked, then the copy and the uploaded files are encrypted and stored off-site in Cloudflare R2. Daily copies are kept for 14 days and weekly copies for 8 weeks. A restore drill runs every month: the latest backup is restored to a scratch copy, verified, and started.
How AI is used
AI runs only when you start it. It receives sheet headers, a few sample rows, notes and cell references, never whole workbooks, and requests are sent with storage disabled at the provider. Its suggestions are proposals: nothing is applied or published until you confirm it, and prices are always calculated by ReadyVariant’s own engine, never by the AI.
Calculations and files
Prices come from the price books and rules you confirmed. Excel formulas, macros and external links are never executed; saved values are read instead. Shared website configurator links show only what you chose to share, never your source sheets or price sources.
Files you send to support
When a schedule, hardware set, specification or price book isn’t read right, you can send that file to ReadyVariant support after ticking a consent box. Nothing is sent otherwise. The file is kept on the same server, outside your workspace and outside the backups. It is opened only to fix how it is read, and deleted after 90 days or as soon as you withdraw it. Support gets an email with the file name and your note, never the file itself. A copy is kept as a test document only with your separate written permission, and with names and addresses removed.
Integrations
Webhooks, API keys and order exports are set up by the workspace owner. A webhook is only sent to an https address that resolves to a public network, never one inside a private network, and each message is signed. API keys are shown once, stored only as a hash and read-only. Internal quote notes, standard cost and margin are never included.
Email and customer links
ReadyVariant sends email for account verification, password resets, team invitations, the notifications and daily follow-up summary you turn on, and the quotes and order acknowledgments you choose to send. A sent quote is a private link, with the quote PDF attached. It comes from ReadyVariant with your company name, and replies go to your verified email. Only a hash of each link’s key is stored; links are kept out of search engines and stop working when you revoke them or 30 days after the quote expires. When a customer accepts, their name, PO number, typed signature, the time and a one-way hash of their network address are recorded on the quote.
Export and deletion
Ask for an export or deletion of your workspace and it is handled within 30 days, sent to or confirmed with the verified owner email. Deletion removes the workspace, its files and its account records; encrypted backup copies expire as retention rolls them out, within 8 weeks. Self-service export is not available yet.
Site statistics and pilot requests
The public site counts page views, demo prices, sample quotes and signups per page and day. It sets no cookies, stores no IP address or browser details, and uses no third-party tracker; the first page of your visit is kept in that browser tab and sent only with a signup or a pilot request. A pilot request is stored with what you typed and emailed to the founder, and is used only to reply. Ask and it is deleted.
What is not in place yet
There is no SOC 2 report, SSO, audit export or data-residency choice in the customer preview. If any of those are requirements, raise them before a pilot so we can say plainly what is and is not possible.
See it with your own data.
Start with one spreadsheet and a result you already know.