Security

Tenant data isolation

Every database query in the product goes through a query-layer guard that scopes it to the requesting business. The design is fail-closed: if a query can’t be proven to be scoped to the right business, it throws an error rather than silently returning — or writing — another business’s data. We have directly tested this by creating two separate accounts and confirming one account’s dashboard shows zero data belonging to the other.

Access control

Every account has a role — Customer, Staff, Admin or Owner — ranked in that order, and each API route declares the minimum role it requires. A lower-ranked role is rejected before it can read or write anything on a higher-ranked route.

Authentication

Sign-in uses a short-lived access token plus a longer-lived refresh token; a refresh token cannot be used in place of an access token. Customer-portal sessions use a separately scoped token type that cannot be used against staff routes.

Encrypted credentials

Third-party integration credentials (for example, a connected messaging or payment account) are encrypted at rest with AES-256, not stored in plain text.

Payment correctness

Payment settlement is designed to avoid double-booked revenue if the same event is delivered more than once — a payment can only move from pending to settled once, checked inside a single database transaction.

Public API

API keys carry their own scopes (for example, read-only access to leads or invoices) and their own rate limit, enforced per key.

Audit logging

Sensitive actions are written to an audit log you can review.

Data export and deletion

There is a built-in mechanism to export or erase a contact’s data on request. We don’t currently assert formal certification against any specific privacy framework (GDPR, PIPEDA or similar) — if that matters for your business, ask us directly via the contact form.

Infrastructure

The product runs as containerized services behind a reverse proxy that terminates TLS. The database and cache are not directly reachable from the public internet — only the application services are, through the proxy.

Questions

If you have a specific security question — a vendor security questionnaire, a request about data handling, anything else — use the contact form and choose “Security.”