Security
How your business data is protected.
A plain description of what we actually do — and, at the bottom, an equally plain list of what we haven't done yet.
Authentication
- Passwords are hashed with bcrypt — never stored or recoverable in plain text.
- Sessions use signed tokens with a fixed expiry.
- Two-factor authentication is available via any TOTP authenticator app, with single-use backup codes.
- Google sign-in is supported for accounts that already exist.
Access control
- Seventeen distinct permissions across four built-in roles: owner, dispatcher, accountant, and technician.
- Custom roles let you grant exactly the permissions a person needs, no more.
- Permissions are enforced on the server for every request — not just hidden in the interface.
- A technician sees only their own assigned work.
Data isolation
- Every record is scoped to your organization, and every query is filtered by it.
- Third-party credentials you connect are encrypted at rest and never returned to the browser.
- An activity log records who changed what.
Payments
- Card details are handled entirely by Stripe and PayPal — they never touch our servers and we never store them.
- Stripe Connect means payouts go directly to your own Stripe account.
- Payment webhooks are signature-verified and processed idempotently, so a retry can't double-post a payment.
In transit and at rest
- All traffic is served over HTTPS.
- Standard hardening on every response, plus rate limiting on authentication and AI endpoints.
- File uploads are stored with a dedicated media provider rather than on application servers.
Your data is yours
- Export your full account as structured data at any time, from Settings.
- Per-customer data export and erasure support GDPR subject requests.
- Cancelling a subscription does not delete your data.
What we haven't done yet
We'd rather you hear this from us than discover it during a procurement review.
No third-party security audit or certification
We hold no SOC 2, ISO 27001, HIPAA, or PCI certification. The practices above are real, but no external auditor has verified them. If your procurement process requires a certification, we are not the right fit yet.
Single sign-on is Google only
There is no SAML, no OIDC beyond Google, and no SCIM provisioning. If you need Okta, Entra, or automated user provisioning, that doesn't exist today.
No formal uptime commitment
We don't publish a status page or offer a contractual SLA.
No customer-managed encryption keys
Data is encrypted using keys we manage. Bring-your-own-key isn't supported.
Questions about any of this? Email security@gruvik.com.
Ready to run your business on it?
Start a 14-day trial today. No credit card, no sales call, no implementation project.
14 days free · No credit card required · Cancel anytime