Legal
Security Overview
1. What this page is
This is the security position published by SDSI Business Systems, Inc. for Rapid Estimator and this website. It is not behind a sign-in, a questionnaire or a non-disclosure agreement. It describes the controls that are in place today. Section 10 states what is not in place.
2. What we hold
The data we hold is described in our Privacy Notice: website logs, contact-form submissions, customer and license records, support correspondence, and payment records. Estimate files, cost books and job data stay on the customer’s PC unless the customer chooses to share a copy during support. The license check sends the serial / license identifier only.
We hold no payment card numbers on this website, no government identifiers, no health data and no sensitive personal information.
3. Encryption
- In transit: TLS on every connection to this website, to Authorize.Net checkout, and to SDSI’s license server in the United States.
- This website is served over HTTPS. HTTP Strict Transport Security is enabled at the host.
- Estimate files on the customer’s PC are protected by the customer’s own Windows accounts and disk encryption, if the customer has turned those on. We do not claim those as our control.
4. Access control
Access to SDSI’s license server, mailboxes and payment administration is limited to SDSI staff who need it to issue licenses, take payment or provide support. The admin site on that server is used by SDSI staff only. Customers do not log in there. Access is removed when a person leaves SDSI.
5. Hosting
This marketing website is hosted by Cloudflare, Inc. in the United States.
License and subscription records sit on SDSI’s license server in the United States, which SDSI Business Systems, Inc. operates. The desktop program connects to the subscription database on that server to verify that the subscription is current. That server is our infrastructure, not a separate company.
Development copies of the admin site are not the live customer database.
6. Payments
Card data is taken by Authorize.Net on its own checkout. We do not store card numbers on rapidestimator.net or on the license host.
7. Remote support
Remote support uses LogMeIn Rescue and starts only when the customer requests a session and enters a PIN. The session ends when the customer or the technician closes it. We do not leave an unattended agent on the customer’s PC.
8. Monitoring and vulnerability handling
Website request logs are retained for 90 days. If you believe you have found a vulnerability in this website or in Rapid Estimator, write to rapidestimator@sdsinow.com with enough detail to reproduce it. We will acknowledge within 3 business days. We will not pursue you for a good-faith report that stays within the law, does not access another person’s data and does not degrade the service.
9. Incident response
Where a breach is likely to result in a risk to individuals, we will notify affected customers without undue delay and notify any United States regulator the law requires. Where we hold data for a client as a processor, we notify that client within 72 hours, on the terms in our Data Processing Terms.
The response sequence is: contain, establish what was affected, notify, remediate, and record what changed.
10. What is not in place
This section exists because the absence of a control and the absence of a claim are different things.
- SDSI Business Systems, Inc. holds no SOC 2 report and no ISO/IEC 27001 certification.
- We have not commissioned an independent penetration test of this website.
- We operate no 24-hour security operations centre. Incident response is human and business-hours, with on-call support for Priority and Enterprise customers.
Each of these is a decision proportionate to a desktop product whose estimate files stay on the customer’s PC, and each is revisited as that changes.
11. Changes
This is version 1.0, published on 18 August 2026. When a control changes we publish the new version at this address with a new version number and date.
12. How to reach us
Write to rapidestimator@sdsinow.com. Our other published documents are indexed on the Legal page.