🌐 Encryption in transit
- TLS 1.3 on every web page, mobile API call, and WebSocket. Browsers refuse to load ServiceHQ over plain HTTP.
- HSTS preload — browsers remember ServiceHQ is HTTPS-only and won't try insecure connections.
- Encrypted SMS / email transport via Twilio and Resend — both deliver over TLS to the receiving carrier or mailbox provider.
💾 Encryption at rest
- AES-256 at rest on our PostgreSQL database (managed by Railway).
- AES-256 at rest on photo uploads and call recordings stored in object storage.
- Bcrypt-hashed passwords — we never store your password in plain text. Even our engineers can't read it.
- Signed tokens — every session, accept-link, and unsubscribe token is cryptographically signed (
HMAC-SHA256) so they can't be forged.
🏢 Multi-tenant isolation
- Every query filtered by
company_id. There's no path in the codebase that lets a dispatcher in Company A see a job, customer, or partner in Company B. - Granular per-agent permissions. Company admins decide which teammates can see Stripe payouts, issue refunds, manage bank accounts, or view customer data.
- Audit logs on every job state change — who changed what, when, and from where.
- Server-side enforcement. Even if someone tampers with the browser to un-hide a button, the backend will still 403 the request.
💳 Payment security
- PCI-DSS Level 1 via Stripe — the highest tier of payment-card security certification. No card data ever touches our servers.
- Stripe Connect destination charges. Customer payments deposit directly into your Stripe Connect account, not ours. We can't move your money.
- 3D Secure step-up authentication automatically applied when Stripe's risk engine flags a charge.
- Stripe Radar fraud detection on every transaction at no extra cost.
🔐 Authentication & access
- JWT sessions with rotation — sign out anywhere and every device is logged out instantly.
- Password reset flows use single-use, time-limited tokens delivered via email.
- Per-agent role + permissions — admins see everything, dispatchers see jobs, technicians see only their own assigned work.
- Tenant-scoped tokens — a partner's token can only access their partner row; a dispatcher's token can only access their company's data.
📋 Operational security
- Secrets out of source code. API keys, database URLs, and signing keys are stored in Railway's secret manager, never committed to git.
- Rate limiting on every authentication, payment, and job-creation endpoint — defends against brute force and abuse.
- Idempotency keys on Stripe charges, refunds, and payouts — a network glitch never double-charges or double-refunds a customer.
- Input validation on every API endpoint to defend against injection and malformed data.
- Sentry monitoring for errors and anomalies in production. Crashes get triaged the same day.
Why ServiceHQ isn't end-to-end encrypted
Apps like WhatsApp and Signal use end-to-end encryption: even WhatsApp's own servers can't read your messages. That works because the only thing those apps need to do is move text between two phones.
ServiceHQ does more than move messages — we route jobs to the right partner based on zip code, service type, and coverage; we render dashboards showing your customer info; we generate receipts and invoices; we run analytics. All of that requires the platform to actually read the data.
This is the same trade-off Stripe, Square, ServiceTitan, Jobber, and Housecall Pro make. The right comparison isn't WhatsApp; it's a payment processor or CRM. Our security model is encryption in transit + encryption at rest + access controls + audit logs — the standard for SaaS handling money and customer data.
Inside ServiceHQ, only people you authorize can see your company's data. Outside ServiceHQ, the wire is encrypted and the storage is encrypted. That's the boundary.