HOTPASS
← Back to Hot Pass
Last updated 4 August 2026
Written for whoever in your organization has to sign off on a new vendor. It is not a sales page and it does not describe what the product does — how it works covers that. This one answers the three questions an IT department actually has: can our data leak, can we get it back out, and what happens if the vendor disappears.
These are the answers you would otherwise spend a questionnaire round trip extracting. Getting them in the first email is worth more to both of us than getting them in week three.
| Control | Detail | |
|---|---|---|
| SOC 2 / ISO 27001 | No | No certification, and none currently in progress. If this is a hard gate in your procurement process, it is better to know now. |
| Third-party penetration test | No | Not commissioned. Security is tested by an automated suite that runs against the real database, described below. |
| SSO / SAML / SCIM | No | Email and password, with reset by email. No directory integration and no automated deprovisioning — removing someone is a manual step in the app. |
| Uptime SLA | No | Nothing has been measured, so nothing is claimed. An availability commitment can be written into an enterprise agreement; it would be a commitment made going forward, not a statistic about the past. |
| Audit log | Yes | Append-only, written by the database. Covers records, projects, membership and billing changes. |
| Encryption | Yes | TLS in transit, AES-256 at rest, both provided by Supabase and AWS. No customer-managed keys. |
| MFA | No | Not offered today. |
| Registered legal entity | In progress | Company registration has not completed. If your process needs a W-9, a certificate of insurance, or an entity on the signature page, raise it early — this is the item most likely to set the timeline. |
This is the part worth your reviewer's attention, because it is the one structural decision that changes what a frontend bug can do.
Every access rule lives in PostgreSQL row-level security policies, evaluated by the database on every query against the caller's own identity. The browser holds a public key that is not a secret and is visible in the page source; it carries no privileges of its own. A user's reach is decided after the query arrives, by rules the user's session cannot alter.
The practical difference: a read-only auditor seat is read-only because the database refuses the write. Not because the button is hidden. Give that account a token and a terminal and it still cannot insert a row, because nothing in the client is part of the boundary.
Every schema change ships with a probe that proves the rule by behaviour rather than by inspection. The probe signs in as a real user, writes a real row, then attempts to read and modify it from a second account and counts what came back.
That habit exists because of a specific failure. A permission guard was once shipped that existed, reported as enabled, and did nothing — it was written as a permissive policy where it needed to be restrictive. Listing the policies showed it present. Only trying the write showed it was inert.
United States, in AWS us-east-1, via Supabase. There is no other region option today, so if your data must stay in the EU, Canada or the UK, this is not a fit and no contract term changes that.
| Subprocessor | What it holds or sees |
|---|---|
| Supabase (AWS us-east-1) | The database, file storage and authentication. All customer records and uploaded attachments. |
| Netlify | Static hosting for the application page. No customer records pass through it — the browser talks to Supabase directly. |
| Stripe | Payment processing. Card details are entered on Stripe's own hosted page and are never seen or stored by Hot Pass. Holds billing contact and subscription state. |
| Resend | Transactional email — invitations, reminders, the export notice on cancellation. Sees recipient addresses and message contents. |
| Anthropic | Only if AI document pre-fill is used, which is opt-in and separately purchased. The specific document being read is sent for extraction. If the feature is never used, nothing is sent. |
| Umami | Page analytics on the marketing site. Cookieless, which is why there is no consent banner. No customer records. |
| Esri / ArcGIS | Basemap tiles for the weld map. Sees map tile requests, not record contents. |
| Cloudflare CDN, jsDelivr, Google Fonts | JavaScript libraries and webfonts. Static assets only. |
Everything. There is a service key that bypasses row-level security, it is required for the system to function — billing webhooks and scheduled email run with it — and it is held by the founder.
So the audit log is an accurate record of what your own people did, and it is not a tamper-proof ledger against us. Describing it as one would be a claim the architecture does not support. Any vendor whose security page implies otherwise while holding an equivalent key is telling you something that is not true.
Every table exports to CSV from inside the app, at any time, with no request to anyone. Attachments download as the files they were uploaded as.
If a subscription ends, the account becomes read-only rather than closed for 90 days: sign in, read, print and export everything, just no new entries. A complete JSON export is emailed automatically when the subscription ends, so nobody has to remember to ask. An enterprise agreement can set a longer window than 90 days, and that term is written into the agreement rather than left to the default.
There is no proprietary format anywhere in this. The records are rows in PostgreSQL and the attachments are the original files.
Hot Pass is built and run by one person, Jacob Horton. That is the risk your reviewer should weigh most heavily, and it is not one that better architecture answers.
What limits the damage is that nothing about the data is exotic. It is standard PostgreSQL and unmodified original files, you can export the whole of it today without asking, and an export is sent automatically if billing lapses. A source escrow arrangement or a continuity clause can be written into an enterprise agreement — ask, and it goes in.
The same system has been built for two other trades — Sparky QC for electrical and CodeShop QC for ASME code shop fabrication. If your company is evaluating more than one, the architecture matters to you.
They share no database, no authentication, and nothing at runtime. A customer using two of them has two accounts, two logins and two invoices, and there is no single sign-on between them. That is a deliberate separation rather than an unfinished integration, and it is a real constraint on how a bundle can be bought. The enterprise page covers what that means commercially.
The application is a single page that runs in the browser with nothing to install. A Content-Security-Policy is served on every response, restricting script, style, frame and form-action sources; frame-ancestors is none, so the app cannot be embedded in another site.
There is an Android app, which is the same page in a native wrapper. It has no MDM integration and no managed configuration.
Sharing a punch list with someone outside the account produces a link containing a token that is stored only as a hash and displayed exactly once. Anyone holding that link holds that punch list — the URL is the credential, which is why it expires and can be revoked. If a link goes to the wrong address, the fix is revoking it and issuing a new one; it cannot be recovered or resent.
Send the questionnaire. It reaches Jacob Horton directly at support@hotpassqc.com, and the answer will name what is not built rather than route around it. A control that does not exist gets a date if it becomes part of an agreement — it does not get described in the present tense.
Hot Pass QA/QC — Texas, USA. Company registration in progress; full business details will be published once filed. See also the Privacy Policy, the Terms of Use and the enterprise and partner terms.
Security and architecture — hotpassqc.com/security