How Odin Technology Group LLC (operating as Doorstep) encrypts, retains, and processes data · Last updated October 13, 2026
Doorstep runs the homeowner portals, scheduling, invoicing, and customer communications for home service contractors. This page describes, in plain terms and without overstating it, how we protect the data that passes through the platform. For the contractual version of these commitments, see the Data Processing Agreement.
All traffic to and from Doorstep is encrypted in transit over TLS 1.2+. Data at rest — customer records, appointments, invoices, messages, and uploaded photos — is stored in Supabase's managed Postgres infrastructure, which encrypts data at rest at the database and storage layer. Application access to that data is additionally restricted by row-level security policies enforced at the database layer, so a contractor's account can only ever read its own records.
No system is unbreakable, and we don't claim otherwise. These are the concrete measures in place today; they may be updated as the platform grows.
When a contractor account is terminated, Doorstep doesn't keep that contractor's or its customers' data indefinitely. A scheduled job runs daily against every cancelled account and, once a cancelled account has been inactive for 90 days, permanently and irreversibly removes its Personal Data from Doorstep's active production database — not a soft delete or a disabled flag, an actual row-level purge. The same daily job also expunges expired PII from stale signup and feature-request submissions, and scrubs old inbound webhook payloads once they're past their retention window, each as an independent step so one failure doesn't stop the others from running on schedule.
Before that 90-day purge runs, a cancelled contractor has a 30-day self-serve window to export its customer records, plus a support-assisted export option for 30 days after that. Full detail on the export windows and backup rotation timeline is in Section 7 of the DPA.
Doorstep is built on a small number of established infrastructure providers. Each one processes a specific slice of data in order to provide the Services — none of them are given more access than their role requires.
| Provider | Role |
|---|---|
| Supabase, Inc. | Database, authentication, and file storage infrastructure |
| Stripe, Inc. | Payment processing and subscription billing |
| Twilio Inc. | SMS delivery and inbound message handling |
| Resend, Inc. | Transactional email delivery |
| Vercel Inc. | Application hosting and edge delivery |
| Sentry (Functional Software, Inc.) | Application error monitoring and diagnostics |
| Anthropic, PBC | AI-generated automated SMS replies, job-note summarization, and draft estimate line items — each opt-in per contractor, always reviewed before saving |
The complete, legally current subprocessor list — including location and the general authorization contractors grant for each — is maintained in Section 4.4 of the DPA, which is the controlling document if anything here is out of date.
Platforms a contractor optionally connects with its own account — GoHighLevel, Jobber, Housecall Pro, JobNimbus, QuickBooks Online, Stripe Connect, and Google Drive — are each the contractor's own processor, not Doorstep's subprocessor. See Section 4.4.1 of the DPA for how those integrations are scoped.
For security questions, data requests, or anything else covered here, reach us at privacy@heydoorstep.com. For the full contractual terms, see the Data Processing Agreement and the Privacy Policy.
Odin Technology Group LLC d/b/a Doorstep · 359 Zancara Street, St. Augustine, FL 32092 · privacy@heydoorstep.com · heydoorstep.com/security