Security & trust
This system holds your contracts and your clients' deposits.
Which means the guardrails have to hold when someone leans on them — not merely hide a button. Here is what is actually enforced, and where.
Access enforced in the data layer
Every project-scoped query composes the same access filter. Hiding something in the interface is presentation; this is the actual control.
A crew member's project query returns only their assigned projects because the filter is part of the query — not because a page declined to render a link.
Crew see no money
Field accounts have no access to dollar figures anywhere in the product. Your labor rates and margins do not travel to a job site.
Not a hidden column — the field app has no financial views to reach.
Two-factor authentication
Available on every plan and enforceable org-wide on Enterprise. Passwords are hashed with scrypt, never stored or logged in the clear.
Standard TOTP — Google Authenticator, 1Password, Authy. No SMS, which is the weakest common second factor.
Signatures with an audit trail
Each signature records the consent text as shown, the signer, the timestamp, the IP, and the user agent. The contract locks and cannot be edited afterwards.
Written once and never updated — an append-only record is only worth something if nothing can quietly rewrite it.
Client money held, not forwarded
Progress payments sit in escrow through an inspection period you configure. Neither party can shortcut it.
Release is refused both before the client approves and before the inspection window elapses — two independent conditions, each checked server-side.
Tenant isolation
Your organisation's data is scoped at the query level. Another contractor on the platform cannot reach it, and neither can their owner account.
Cross-tenant reads are confined to one deliberately separate admin surface, gated on a platform-staff flag that no customer account can hold.
What we don't claim
Security pages tend to imply more than is true. Here is the honest boundary.
- SOC 2 is not certified. The system is built to the controls a SOC 2 audit looks for — access control, audit logging, encryption in transit, least privilege — but no audit has been completed and we will not imply otherwise.
- No penetration test has been published. When one is, it will be linked here with its date and scope.
- Card details never touch our servers. Payments run through Stripe's hosted flow, so we hold a reference and never a card number.
- This public deployment is a demo. It runs on a pre-seeded snapshot rather than a production database — sign-ins work and writes appear to succeed, but they are not durable. Do not put real job data into it.
Questions we haven't answered here?
Security reviews are a normal part of choosing software that holds contracts and deposits. Open the demo and probe it — that is what it is for.