Current security posture
The app keeps each company's records separate, limits sensitive work by role, requires two-step login for high-risk actions, protects private files, and records important security events.
New high-risk actions must keep the company boundary, approval step, and review history visible before they are allowed in the product.
Payment and card-data boundary
Stripe remains the card-data processor. Trades Operator does not store raw card numbers. The app stores payment status, refund and dispute history, payout proof, and matching status for the right company.
AI and customer actions
Operator AI can summarize, rank, and draft from the contractor's own records. It should not send customer messages, charge money, schedule work, or change books without human approval.
Roadmap and non-claims
Trades Operator is building toward third-party review, SOC 2 evidence, access reviews, restore drills, vendor reviews, and a fuller trust center. It is not currently claiming SOC 2 certification, enterprise compliance, automatic legal compliance, or zero risk.
Report security concerns to support@tradesoperator.com.