Passwords are hashed.
Passwords are stored using salted scrypt hashes, rather than readable password values. Account activation requires a password between 12 and 128 characters.
Trust & security
Practical protections.
Clear information.
Here is what the current application implements to protect access to your workspace and records.
Sessions have limits.
Production session cookies use Secure, HttpOnly and SameSite=Strict settings. Server-side sessions expire after 12 hours.
Access is checked on the server.
Workspace membership and role checks protect application API operations. Technician access to job sites is checked against assigned crews.
Activation links expire.
Team and company-account activation links are single-use and expire after 48 hours. Redeeming a reset link invalidates the account’s prior sessions.
Sign-in attempts are limited.
The application limits repeated sign-in and activation attempts. Requests that change application data must pass a same-origin check.
Uploads have boundaries.
Application uploads are subject to size and file-type limits. Product photographs are checked for matching image signatures; protected file routes check workspace access.
These statements describe application controls reviewed for this website release. They are not a security certification, independent audit or guarantee against every threat.
Your part in
workspace security.
Use a strong, unique password. Keep activation links private and give team members only the access they need.
Questions about a specific requirement?
Ask us before relying on a particular compliance standard, data residency commitment, backup schedule, encryption-at-rest guarantee, single sign-on or multi-factor authentication feature. Those commitments are not represented as verified capabilities here.
Contact us about security ↗A clearer view of your business starts here.
Let’s talk about your team, your sites and the way you work.