Your Protection, Built Into Every Step
Six pillars of trust keep you safe from start to finish.
License Verification
Every contractor on Mr.GC is auto-verified against New York City DOB, ECB, and DEP license databases before they can accept any job. We check license validity, insurance status, and violation history.
Escrow Payments
When you book a contractor, Stripe places a secure hold on your card. Funds are never released to the contractor until both parties confirm the job is complete. Your money is protected at every step.
OTP Arrival Verification
A unique 4-digit code is generated for each job. The contractor must enter this code — shared by you in person — to prove they've physically arrived. No OTP, no timer, no charge.
Live Work Timer
Once the OTP is verified, a real-time timer starts and is visible to both customer and contractor. You always know exactly how long work has been in progress. No surprise overcharges.
Dual Confirmation
Payment is only released when both the customer and the contractor independently confirm the job is complete. Neither party can unilaterally trigger settlement — both must agree.
Dispute Resolution
If something goes wrong, our dispute resolution system uses AI-powered severity classification to assess the situation, followed by human arbitration. Fair outcomes for both sides.
Anti-Fraud Protections
Mr.GC actively protects both customers and contractors from fraud, scams, and platform abuse. Here's how we keep the marketplace safe.
- In-app messaging is content-filtered to prevent sharing personal contact information or arranging off-platform deals
- Payment information is handled exclusively by Stripe — Mr.GC never stores your card details
- Contractor profiles are locked to verified license holders — no impersonation possible
- Photo uploads are analyzed by AI for authenticity and relevance to the reported issue
- Rate manipulation detection flags suspicious review patterns automatically
- Two-factor verification through OTP prevents unauthorized job starts
Data Security
Your data security is non-negotiable. Mr.GC is built on industry-leading infrastructure designed to protect your personal and financial information.
- Stripe PCI Compliance — All payment processing is handled by Stripe, a PCI Level 1 certified payment provider. We never see or store your card numbers.
- Row-Level Security (RLS) — Database access is enforced at the row level via Supabase RLS policies. You can only access data that belongs to you.
- Bcrypt-Hashed OTPs — One-time verification codes are hashed with bcrypt before storage. Even in the unlikely event of a database breach, OTPs cannot be reversed.