Security at PDP Automation

The application uses Lovable-managed hosting, authentication, and database services. Administrative access is limited to separately assigned administrator accounts.

• The published application is served over HTTPS for encryption in transit.
• Encryption at rest is provided by the managed hosting and database services, rather than by application-level encryption in PDP Automation.
• Payment card details are handled by Stripe and are not stored by PDP Automation.

Signed-in agents can only reach their own records or records shared with their agency team. Row-level security enforces those boundaries in the database, and administrator access is assigned separately.

Client intake links use 192-bit random tokens stored only as hashes. They expire after 30 days, and an old unused link is revoked when a replacement is issued. Intake and results pages tell search engines not to index or follow them. Results links do not currently expire, so they should be treated as private and not forwarded.

PDP Automation does not currently run an automatic deletion schedule for client records. Records may be retained for support, legal, and accounting needs. Agents and clients may request deletion by emailing support@pdpautomation.com.

• Lovable provides managed application hosting, database, authentication, and email delivery services.
• Stripe processes payments, receipts, tax, and billing.
• Photo and document reading uses Google's Gemini model through Lovable's AI service to create an editable medicine list.
• Google Ads receives purchase measurement after the site's regional advertising-consent rules allow it.

If you believe information is exposed or an account is compromised, contact support@pdpautomation.com immediately with enough detail for us to investigate.