Security

Each business's data is isolated at the database level, not just in the application. Row-level security policies are enforced by the database itself, so one business cannot access another's records. Only admins can perform administrative tasks like inviting team members, changing roles, or exporting reports.

• All traffic is encrypted with HTTPS (TLS). Browsers are instructed to always use secure connections via HSTS headers.
• Data at rest is encrypted by our database provider (Supabase).
• Job photos are stored in private buckets, visible only to members of that business.
• Team invite links are randomly generated, single-use, and expire after a set period.
• Browser security headers prevent the application from being framed by other sites.

• Two-step login (two-factor authentication) is available and can be enabled in Settings.
• Passwords are stored by our authentication provider (Supabase Auth). Tendovio never sees or stores your password directly.
• An activity log records key actions, such as sending invoices, changing team members, and updating business settings.

When card payments launch, they will be handled entirely by Stripe. Tendovio will never store full credit card numbers. Payment data flows directly between your browser and Stripe's servers.

Our database provider performs automated daily backups. In the event of data loss or a service disruption, we can restore from the most recent backup. Backups are encrypted and retained according to our provider's schedule.

If we detect or are notified of a security incident, we will:

• Investigate promptly to determine scope and impact.
• Take immediate steps to contain and resolve the issue.
• Notify affected account holders by email within 72 hours of confirming a breach.
• Notify relevant authorities where required by law.
• Document the incident and any steps taken to prevent recurrence.

• We review code and database configurations regularly.
• Dependencies are kept up to date, and security patches are applied promptly.
• Issues are addressed quickly when discovered or reported.

We have not yet had an independent security audit. When we do, we will note it here.

If you discover a security vulnerability, please email [email protected]. We take all reports seriously and will not take legal action against anyone who reports a security issue in good faith.