Security
Data security at Oifers
What happens to your company's data and your clients' data: where it is stored, who sees it, how the quote reaches the client and how you pay for the subscription. We describe what the app does today; the legal details are in the privacy policy and the terms.
Where the data is stored
- The app, the database and uploaded files are hosted by DigitalOcean, in its Frankfurt data centre in Germany (European Union).
- The connection between your browser and Oifers is encrypted (HTTPS) on the website, in the app and on the quote link.
Who sees your company's data
- Each company's data is kept separate: one company's products, clients, quotes and supplier requests do not appear in another company's account.
- Each colleague has their own account. The administrator manages users, company details and the subscription; sales agents work with quotes, clients and the catalog.
- Suppliers do not enter your company's account: they only see the request for quote you send them and reply from their own account.
Accounts and sign-in
- Passwords are stored only as a hash, never in plain text.
- You sign in with email and password or with your Google account.
- Sign-in attempts are limited, so a password cannot be guessed by repeated tries.
- An account has one active session: when you sign in on another device, the old session is closed.
The quote link and online acceptance
- The quote reaches the client as a link with a long, randomly generated code that is hard to guess. Quote pages are not indexed by search engines.
- The client accepts the quote with a 6-digit code sent by email. The code expires after 10 minutes and the number of attempts is limited.
- Google Analytics is not loaded on the quote page or on the supplier request page.
- Oifers records when the quote was opened, so you know when to follow up. Let your client know about this processing.
Paying for the subscription
- The subscription is paid through Stripe. Card details are entered on the Stripe page and do not pass through Oifers servers.
- Of the card details, we keep only the last 4 digits and the payment identifiers, to show you which card you pay with.
GDPR: who is responsible for the data
- For your clients' data that you enter in Oifers, your company is the controller and Oifers is the processor (Article 28 GDPR). The data processing agreement is part of the Terms of Service.
- The service providers that process data for Oifers (hosting, email, payments, analytics) are listed in the privacy policy, with the country where they process it.
- Google Analytics loads on the website only if you accept analytics cookies.
- You can export your products, clients and quotes to Excel or CSV at any time.
The full documents
This page is a summary. What data we process, how long we keep it and what rights you have are set out in:
Found a security issue?
Write to us at oifers@oifers.com with a description of the issue and the steps to reproduce it.
We use cookies that the site needs to work. With your consent, we also use Google Analytics for usage statistics. Cookie policy