Legal center

Security at Pool AI

MIAMI POOL CONSULTANTS, DOING BUSINESS AS POOL AI · LAST UPDATED: OCTOBER 2026

1. Encryption

• In transit. Every connection to mpcpoolai.com uses HTTPS (TLS 1.2 or newer). Plain HTTP is redirected to HTTPS, and browsers are told to always use HTTPS (HSTS). Our server's connections to the services we use are also encrypted.
• Passwords. Passwords are stored only as bcrypt hashes. We can't see your password.
• Sign-in links, codes and session tokens are stored only as hashes, and they expire.
• Connected services. Access tokens for Gmail, Outlook and QuickBooks are encrypted with AES-256-GCM. The key is kept apart from the database.
• Backups are encrypted before they leave the server.

2. Sign-in and access

• Homeowners sign in with a one-time code sent by email. There's no password to steal.
• Company users sign in with their own email and password, and the password has a minimum length. Each person gets their own login, so logins are never shared.
• Limits on sign-in attempts. Repeated attempts are slowed down or blocked.
• Roles. Companies give each person a role: owner, office or tech. Our server checks the role before showing or changing sensitive information such as pay, billing and settings.
• Separation between companies. Every company's data is kept separate. One company can never see another company's records.
• Removing access. When a company removes a team member, that person's sessions end immediately.
• MPC staff access. Access to customer data at MPC is limited to named people who need it to run and support the service.

3. Payments

Card and bank details are entered directly into Stripe's secure forms and never reach Pool AI's servers. Stripe is certified to the highest level of the card industry's security standard (PCI DSS Level 1). Pool AI sees only details such as the card brand, the last four digits and whether the payment went through.

4. Application and infrastructure security

• Pool AI runs on a dedicated hosting provider in the United States.
• Private files, such as the database, uploaded documents and settings, are kept in a protected folder that can't be reached from the web.
• Uploaded files are checked by type and size, and they're stored under random names.
• Database queries are written in a safe form that protects against injection attacks.
• Our website sends modern browser security headers, for example blocking framing and content sniffing.
• Every change to the live service is checked, backed up and recorded before it goes live, so it can be undone.

5. Backups, monitoring and incidents

• Backups. The database is backed up every night. Each backup is encrypted and checked, and a copy is stored off the server.
• Monitoring. Errors are recorded, and we're alerted when they happen. Secrets are removed from error reports.
• Logs. Security-related actions, such as sign-ins, team changes and account deletions, are written to an audit log.
• Incidents. We have an incident response plan. If a security incident affects your data, we'll tell you without undue delay and follow the law on notifying people. For companies, the Data Processing Addendum explains how we notify them.
• Your data and privacy. We never sell personal information. The outside services we use are listed on Services we use.

6. Reporting a security issue

If you think you've found a security weakness in Pool AI, please tell us. Email info@mpcpoolai.com with the subject "Security report". Include what you found, where you found it, and the steps to reproduce it.

• We'll confirm we received your report within 5 business days and keep you updated while we fix it.
• Please give us reasonable time to fix the problem before you share it publicly.
• Please only test with your own accounts. Don't access, change or delete other people's data, and stop as soon as you've confirmed the issue.
• Don't run denial-of-service attacks, spam, social engineering or physical attacks, and don't test the services we use (such as Stripe or Google). Those services have their own programs.

We won't take legal action against anyone who reports a problem in good faith and follows these rules. We don't run a paid bug bounty at this time, but we're happy to thank you publicly if you'd like.

7. What you can do

• Use a strong, unique password for your Pool AI Pro login, and don't share it.
• Remove team members' access as soon as they leave your company.
• Give each person only the role they need.
• Watch out for emails pretending to be from Pool AI. We'll never ask for your password or card number by email or phone.