Your data is yours, and separated at the database.

Tenant separation

Every record carries the company that owns it, and access is enforced by row-level security in PostgreSQL. A query that forgets to filter returns nothing rather than someone else’s jobs — the separation does not depend on application code being written correctly every time.

Access by us

Support staff cannot browse your data casually. Acting on a tenant’s behalf requires an explicit session with a stated reason, expires within the hour, defaults to read-only, and every change made in that state is recorded with before-and-after values in an audit log.

Worth knowing: the platform now includes internal team messaging, including direct messages between your staff. An administrator acting on your account can read them. That is how impersonation works and it is audited — but it is a different kind of access from business records, so we would rather you heard it here than discovered it.

In transit and at rest

All traffic is served over HTTPS. Data is stored on managed Postgres with encryption at rest, and file uploads are held in private storage reached only through short-lived signed links — customer documents are not sitting on a public URL.

Credentials for connected mailboxes and accounting integrations are encrypted with a separate key before storage, and are never sent to a browser.

On the mobile app

Your session is held in the device keychain. Job data cached for offline use is stored unencrypted on the device, so a company phone should have a passcode — a lost phone means addresses and customer phone numbers are readable.

What we do not claim

We do not hold a SOC 2 report, an ISO certification, or a third-party penetration test. We are a young platform and saying otherwise would be untrue. If your insurer or a partner requires one, tell us — it changes what we prioritise.

Reporting something

If you believe you have found a vulnerability, email us and we will respond. We would much rather hear it from you.