Security
What follows is what the product does today. Where we haven’t done something yet, it says so rather than implying otherwise.
One login can run several businesses, and they never see each other. The separation is enforced in the database on every row, by policies that run underneath the application — not by the screens asking nicely. A query that forgets to filter by company returns nothing rather than somebody else's kit list.
Permissions are per-record, not merely per-screen. Expenses is the clearest case: being able to open the screen does not make somebody else's claim visible on it, because the rule about who may read a claim lives on the claim.
An emailed sign-in link works once and expires in fifteen minutes. Company SSO is not built — there is no SAML and no SCIM provisioning today. If your IT department requires it, say so early and we will tell you honestly where it sits rather than implying it exists.
Access is granted by role templates that match what somebody does — warehouse, crew, office, admin — with per-person overrides where a real job does not fit a template. Somebody with no role assigned can use nothing, and the dashboard says so rather than leaving them to discover it.
A quote, an invoice, a driver's delivery note: each is a coded link scoped to that one document. It is not an account, it grants nothing else, and the customer or driver holding it never sees the inside of your business.
Your data is backed up, and it is exportable — the kit list, the jobs, the customers. Leaving is a thing you can do without asking us to do it for you.
Compass is early. There is no SOC 2 report, no ISO 27001 certificate and no completed penetration test to hand you. If your procurement process needs one, tell us what and when — we’d rather know than be asked at signing.
