Security

Security you don't have to think about

What we do today, what's coming next, and where the data lives. Honest, specific, no buzzword bingo.

Data protection

Every byte you put into SalesThumb is encrypted in flight and at rest.

LiveTLS 1.2+ enforced on every connection — HTTP traffic is automatically upgraded.
LiveDatabase encryption at rest (Neon managed Postgres on AWS).
LiveFile storage encrypted at rest on Cloudflare R2 (AES-256).
LiveTime-limited signed-URL access for sensitive files — warranty PDFs, appointment photos, org documents.
RoadmapCustomer-managed encryption keys (BYOK).

Tenant isolation

Shops can't see each other's data. Period.

LiveEvery tenant-owned row carries a shopId or orgId; every query filters by it.
LiveServer-side guard at the procedure layer — never relying on the client to scope.
LiveSubdomain routing per shop — no cross-tenant cookie reuse.
LiveHQ org admins access child shop data only through audited org-membership checks.
RoadmapPer-tenant row-level security policies in Postgres for defense-in-depth.

Authentication & access

Strong defaults, role-based controls, and single sign-on with Google.

LiveEmail + password with bcrypt hashing (Better-Auth), plus Google OAuth sign-in.
LiveRole-based access: Owner, Admin, Manager, Technician, Front Desk, Service Writer per shop, plus owner-configurable permission sets for HQ/franchise orgs.
LiveTOTP two-factor authentication with backup codes, enforceable org-wide.
LiveSession management from settings — see every signed-in device and log any of them out, or all of them at once.
LiveOptional CIDR-based IP allowlist to restrict our own internal admin console.
RoadmapWebAuthn (passkey) two-factor authentication.
RoadmapSAML / OIDC single sign-on for Pro.

Application security

Boring fundamentals done right.

LiveTypeScript end-to-end + Zod input validation on every API procedure.
LiveDrizzle ORM uses parameterized queries — no string-concat SQL anywhere.
LiveCSRF protection on cookie-authed routes; same-site session cookies.
LivePayment webhook signature verification on every event.
LiveTwilio webhook signature verification on every inbound SMS / call status.
LiveRate limiting on authentication and other sensitive endpoints.
LiveSSRF guard on every tenant-configured outbound URL (integrations, webhooks) — blocks internal/private-network targets, including DNS-rebinding protection.
RoadmapAnnual third-party penetration test.

Infrastructure

Modern, audited platform partners do the heavy lifting — the certifications below are the providers' own; SalesThumb's own SOC 2 is not yet started (see Compliance).

LiveApp tier on Vercel — SOC 2 Type II certified, SSAE 18, HIPAA BAA available.
LiveDatabase on Neon — SOC 2 Type II, point-in-time recovery, daily backups.
LiveFile storage on Cloudflare R2 — SOC 2 Type II, ISO 27001.
LiveEmail on Resend — SPF, DKIM, DMARC enforced.
LiveAll vendors require MFA for our internal admin access.

Operations & response

What happens when something goes wrong.

LiveAutomated daily database backups with 7-day point-in-time recovery.
LiveAudit log per shop — every settings change, role change, and sensitive action recorded.
LivePublic status page at salesthumb.com/status.
LiveSecurity incident notification within 72 hours of confirmed impact.
RoadmapPublished RTO / RPO targets and disaster recovery drills.

Compliance & certifications

Where we are today; we'll publish artifacts as audits land.

SOC 2

Not started

No third-party audit engagement yet. Planned post-launch — we'll publish real dates once an auditor is engaged, not before.

GDPR (Data Processing Addendum)

Available

Email info@roffik.com to receive a signed DPA.

PCI compliance

By design

Card data is handled entirely by our payment processor — we never store full card numbers on our servers.

TCPA opt-out

Enforced

STOP / START keywords are honored automatically; opt-outs persist across channels.

Found a vulnerability?

Responsible disclosure is welcomed and credited. Email info@roffik.com with reproduction steps and we'll acknowledge within 24 hours.

Common questions

Where is my data stored?+

Application data lives in a managed Postgres instance on Neon (AWS us-east-1 by default). Files (photos, PDFs, certificates) live on Cloudflare R2 with global edge distribution. Both providers carry SOC 2 Type II attestations.

Can SalesThumb employees see my data?+

Direct database access is restricted to a small list of named operators on call for incidents, all of whom have MFA enforced. Routine support happens through impersonation tokens that are scoped, time-bound, and recorded in the per-shop audit log. We don't browse customer data for any reason except a documented support request.

What happens if I cancel my subscription?+

Your data stays exactly where it is for 60 days, accessible via export. After 60 days of cancelled status it's deleted from the live database; backups follow the standard 7-day retention. Email info@roffik.com to request immediate erasure.

Do you store credit card numbers?+

No. Card details are tokenized by our payment processor at entry and never reach our servers. We hold a payment-processor customer identifier and the last four digits of the most recent card — that's it.

How do I report a security issue?+

Email info@roffik.com with a description of the issue and steps to reproduce. We acknowledge within 24 hours and aim to resolve high-severity issues within 7 days. We don't have a paid bug bounty yet but will publicly credit responsible disclosures.