Trust & Security

• Every business record carries its workspace identifier, and Postgres row-level security decides what each signed-in user can read or change.
• Access is tied to an active workspace membership checked on the server, not to what the browser chooses to display.
• Changes that matter, such as approving time or issuing an invoice, run as server-side database functions that re-check the caller’s role.
• An automated test suite tries to read and write across workspaces and must fail to do so.

• Email and password, passkeys, or Google sign-in, each followed by an authenticator or passkey check before the workspace opens.
• Bot protection on sign-in and public forms.
• Invitations are locked to the invited email address and expire after seven days.
• A workspace always keeps at least one active owner.

• Five roles: owner, admin, technician, accountant and read-only, enforced in the database.
• Financial actions are limited to owners, admins and accountants. Integration settings are limited to owners and admins.
• An activity history records who changed what, and approved time and issued invoices keep their original values when corrected.

• RMM connections (NinjaOne, Datto RMM, N-able N-central, Syncro, Atera, ConnectWise RMM, Kaseya VSA, Action1) read device inventory. Nothing is written back.
• Microsoft 365 uses admin consent to read license counts only. No mailbox, file or user content is read.
• PSA migrations from ConnectWise and Autotask read your history and run a dry run you review before anything is saved.
• Connector credentials are encrypted before storage and are never readable from the browser.

• All traffic is served over HTTPS with HSTS. A strict content security policy limits which origins can run scripts.
• Pages that show workspace data are never stored in shared or browser back-forward caches.
• Hosting and database providers encrypt data at rest. Providers that process customer data are listed below.

• Supabase: Database, authentication and file storage
• Vercel: Application hosting and delivery
• Cloudflare: Bot protection on sign-in and forms (Turnstile)
• Resend: Transactional email such as invitations
• Google: Website analytics, only with your consent, and optional Google sign-in

If you believe you have found a security issue, email msp@yea247.com with the details. Please do not access other customers’ data or disrupt the service while testing. We will acknowledge your report within two business days.