Your data, isolated and enforced.
You're trusting us with your tickets, your safety records, and your vendor spend. Here's exactly how that data is separated, protected, and kept yours: enforced at the database layer, not just promised in the interface.
Every company's data is separated in the database itself.
Isolation is enforced by row-level security in our Postgres database, not by application code remembering to filter. The database refuses to return another organization's records, so even a bug in the app can't hand your data to someone else. We verify that isolation directly against production.
What each person can do is enforced where the data lives.
Permissions aren't just hidden in the interface; they're enforced at the database layer. A driver can't reach dispatch or billing controls; an outside operator sees only their own company's tickets. The rules hold even if someone goes around the app.
Encrypted in transit and at rest.
Every connection runs over TLS. Data is encrypted at rest in our managed Postgres database. Files are never served from public buckets; downloads use short-lived, signed links that expire.
Photos and signatures, scoped to your org.
Ticket photos, supervisor signatures, and documents live in your organization's own storage space, reachable only through those expiring signed links, not a public URL anyone could guess.
Invite-only. No open front door.
There's no public self-signup. Accounts are provisioned deliberately, so the only people who get in are the ones you authorize.
A plan that's written down, not improvised.
We keep a documented incident-response plan: severity levels, containment steps, customer-notification thresholds and timelines, and a backup-and-restore runbook. If something ever goes wrong, the response is practiced, not invented under pressure.
We name the vendors behind the platform.
A handful of trusted providers help us run the Iron Suite: hosting, payments, error monitoring, maps, email. We list every one, and what they touch, on our sub-processors page.
What we don't claim.
We don't hold certifications we haven't earned. No SOC 2 badge, no "bank-grade" marketing, no compliance logos we can't back. If a formal audit is worth pursuing as we grow, that's a decision we'll make with our customers, not a claim we'd fake. Everything on this page is how the product actually works today.
See how your data stays yours.
Book a demo and we'll walk the security model with you: the isolation, the access rules, the whole thing.
Book a demo