Security

Encryption

• All traffic to the website and API is served over HTTPS with HSTS enabled. There is no plaintext endpoint.
• OAuth access and refresh tokens (Google, QuickBooks) and telephony auth tokens are encrypted at rest with AES-256-GCM in the persisted database snapshot, so a database copy alone does not yield usable third-party credentials.
• Passwords are stored as scrypt hashes with a per-user random salt, and verified in constant time. We never store or transmit a password in a recoverable form, and we cannot tell you what your password is.
• Full payment card numbers are never stored on our systems. Card data is handled by Stripe.

Tenant isolation

Every data route resolves the caller's account server-side from their authenticated session and scopes the query to it. The account identity is never taken from the request body or query string, so a caller cannot ask for another business's records by naming them. This is enforced on read, on write, on bulk sync, and on single-record update — a fix applied to one entry point is not treated as a fix.

Access control

• Roles within an account — owner, admin, dispatcher, finance, technician — are enforced on the server, default-deny: a capability not explicitly granted to a role is refused, rather than allowed because no rule matched.
• Technician field links are separately scoped signed tokens that carry a token kind, so a link intended for one purpose cannot be replayed against another.
• Deactivating a team member immediately invalidates their access and their field-tracking link.
• Administrative operator routes require a separate operator key, which is never accepted from a URL.

Auditability

Account and record actions are written to an append-only audit trail with the actor, the action, and a timestamp. Clickwrap acceptance records are also append-only: a reacceptance appends a new record and marks the previous one superseded, and there is no route that deletes one. Records store a server-generated timestamp, the caller's verified IP, and a hash of the exact wording shown — a client-supplied timestamp is ignored.

Abuse and availability

• Rate limiting on authentication and API routes, keyed on a provenance-verified client IP — the origin is fronted by Cloudflare with a shared secret header, so a forged forwarding header cannot choose which bucket a request lands in.
• Bot verification (Cloudflare Turnstile) on signup, which fails closed and validates the hostname and action of the returned token.
• Per-account daily send quotas on email and SMS, and metered spend caps on AI features, so one account cannot exhaust shared capacity.
• Payment and telephony webhooks are signature-verified with constant-time comparison; an unsigned or mismatched callback is rejected.
• Standard security response headers, including a Content-Security-Policy and X-Content-Type-Options: nosniff.

Data location, backup and deletion

• Data is hosted in the United States. Our vendors are listed on the Subprocessors page.
• Account data is persisted to a managed PostgreSQL database with provider-managed backups.
• You can export all of your records from the dashboard at any time, without contacting us.
• Account deletion is scheduled 30 days out and can be cancelled by the owner during that window. Financial records and the audit trail are retained afterward for the period the law requires — we say so rather than promise an erasure we cannot perform.

What we do not have yet

• No SOC 2, ISO 27001, or equivalent third-party certification. We do not hold one and do not claim one. Compliance questions are answered in writing — see DPA §10.
• No multi-factor authentication on user login yet.
• No HIPAA BAA. The Service is not designed for protected health information, and the Acceptable Use Policy prohibits submitting it.
• No published uptime SLA.

Reporting a vulnerability

If you believe you have found a security issue, email Tradellen LLC at [email protected] with the subject line SECURITY. Please include what you found, the steps to reproduce it, and the impact you believe it has.

• We will acknowledge your report and keep you updated on our assessment and fix.
• Please give us a reasonable opportunity to fix an issue before disclosing it publicly.
• Please do not access, modify, or exfiltrate data that is not yours, do not run denial-of-service or spam tests, and do not use social engineering against our staff or vendors. Testing within those limits, reported in good faith, will not be met with legal action from us.
• We do not currently operate a paid bug bounty. We do credit reporters who want to be credited.