Security
You are about to put your customer list, your pricing and your revenue into someone else's software. Here is the honest state of it — including the parts that are not finished.
Tenant isolation is enforced in Postgres, not in application code. Every tenant-scoped table carries RLS policies, and a runtime test suite queries as the authenticated role with forged JWT claims to prove a tenant cannot read another's rows.
Payments go through Stripe. Card numbers are entered into Stripe's own elements and we store a token, so the PCI surface stays with the processor.
Six roles out of the box — Owner, Admin, Dispatcher, Salesperson, Technician, Viewer — with thirteen distinct permissions, enforced server-side and again at the database.
HSTS, a strict content-security policy, and Postgres storage managed by Supabase with encryption at rest.
Outbound webhooks are HMAC-signed. Public API keys are minted per workspace, rate-limited, and revocable.
Material changes are written to an activity log per workspace, readable from Reports.
A security page that only lists wins is not a security page.
Running a security review? Email hello@serviceflowiq.com and we will answer your questionnaire directly. Live uptime is on the status page.
Bring them to the call. We would rather answer them up front.