Security & your data
Where your shop's data lives,
and how you take it back.
Written to be checkable. Where something is planned rather than built, it says so — a shop deciding whether to move eight years of history deserves the difference in writing.
Reviewed 12 September 2026
- 01 Where the data lives
- Shop records sit in a managed Postgres database hosted on Railway, in a United States region, encrypted at rest. Traffic is TLS end to end. Uploaded photos and attachments go to object storage — today that is disk-backed storage managed by us; where a shop's volume warrants it we move that shop's media to S3-compatible object storage. We do not currently publish a specific cloud region or a guarantee that no data ever leaves the United States, because we have not audited every provider path well enough to promise it. When we have, the promise goes here with the date it was verified.
- 02 Who can reach it
- Two people hold production access, both named on request. Every shop's records are separated at the database level by row-level security, not by application code alone, so a query that forgets which shop it is for returns nothing rather than someone else's work orders. Support cannot open your records without a request from you.
- 03 Backups
- The database is backed up by our hosting provider on their standard schedule, and we hold the migration history so a database can be rebuilt from a known state. We have not yet run a timed restore drill, so we are not publishing a recovery-time objective. Quoting a number we have not tested would be worth less than saying this.
- 04 Getting your data back out
- Your records are yours. Customers, vehicles, work orders and invoices leave as CSV with attachments in a dated folder, at no charge and with no exit interview. Self-serve export is planned and in build. Today it is a support request answered within one business day, and we will not claim otherwise until it ships.
- 05 Sub-processors
- Railway for hosting and the database. Stripe for card and bank payments. Cloudflare R2 or equivalent S3-compatible storage for media where configured. For outbound email a shop's own provider where connected — Gmail is supported directly — otherwise a transactional sender. Connected mailboxes and phone numbers reach the providers you connect them to. This list is published here and changes with notice.
- 06 What we have not done
- We are not SOC 2 certified and no audit is currently scheduled. We will print the date one completes rather than the word "compliant" beforehand. We have not had a breach; if we do, affected shops hear from us within 72 hours. There is no bug bounty programme yet, and no published security address — reach us through the contact form and a person will reply.
Why this page reads the way it does
Three of these six say
“not yet”.
Every vendor's security page says the same six reassuring things. The useful signal is which ones a vendor is willing to qualify. A shop moving its history should ask any vendor — us included — for the date the claim was last checked, and treat an unanswerable question as the answer.
One price, every user
Leave an address.
We write back with the price in full and a shop that looks like yours.