Security
Your customer list is your business
How it is separated, encrypted, backed up and kept yours — described plainly, without badges we have not earned.
Your data is separated at the database
Every table carrying business data is protected by row-level security, so a query can only ever return rows belonging to the business making it. Separation is enforced by the database itself, not by application code remembering to filter.
Encrypted in transit and at rest
All traffic is HTTPS. The database is encrypted at rest by our hosting provider, and particularly sensitive values — Stripe secret keys, email passwords, accounting tokens — are encrypted again by us before they are stored, so they are unreadable even with database access.
Permissions down to the action
Roles are built from individual permissions rather than fixed tiers, so a technician can be given exactly what their job needs. Every server action re-checks the permission — the interface hiding a button is a convenience, not the control.
Payments never touch our servers
Card details go straight to Stripe from the customer's browser, on your own Stripe account. We never see or store a card number, and the money never passes through us.
An audit trail on the things that matter
Payments, refunds, credit notes and administrative changes are recorded as events rather than overwritten values, so what happened stays answerable after the fact.
Customer links are unguessable and scoped
Customer portal links use a random token tied to one record, and a token for one invoice cannot read another. Draft invoices and unsent quotes are never reachable, even with a valid link.
Your data
- Who can see my data?
- Only people you invite to your business, with the permissions you give them. Our staff do not browse customer data; support access is deliberate, limited and logged.
- Can I get my data out?
- Yes, at any time and without asking us. Jobs, customers, invoices, timesheets and any custom report export to CSV, and accounting exports are formatted for Xero and QuickBooks.
- What happens if I stop paying?
- Your data is not deleted the moment a payment fails. You are warned before anything is removed, and you can export everything in the meantime.
- Where is it hosted?
- On managed infrastructure with automated backups and point-in-time recovery. Ask us and we will tell you the region and provider for your account.
Questions we have not answered
If you have a security questionnaire, a DPA to sign, or a question about where your data lives, ask — we would rather answer it than have you guess.