Current security posture
The app keeps each company's records separate, limits sensitive work by role, requires two-step login at sign-in for people who can move money and a recent two-step check for selected high-risk actions, protects private files, and records important security events.
New high-risk actions must keep the company boundary, approval step, and review history visible before they are allowed in the product.
Encryption and data protection
Data is encrypted in transit over HTTPS/TLS. Our hosting and database providers encrypt stored data at rest, and provider credentials and integration tokens are kept in server-side secret storage that application users cannot read. Private files are served only through short-lived signed links.
Access control
Each company's data is separated at the database level. Users get role-based, least-privilege access, owners can adjust role permissions. Owners, admins, and dispatchers complete two-step login (an authenticator or text code, or a passkey) when they sign in. Selected high-risk actions, such as changing team roles and access, turning on card payments, connecting integrations, and accounting exports, also require a two-step check from the last few minutes.
Vendors
We run on established infrastructure providers, including Supabase (database and authentication), Vercel (hosting), Stripe (payments), and Twilio (calls and texts). We review providers that can process customer data before they go live. A subprocessor list is available on request.
Backups, monitoring, and incident response
Production databases are backed up daily by our database provider (kept 7 days). We are setting up a separate encrypted offsite copy and have not yet completed a full restore test, so we do not promise a specific recovery time or recovery point. We monitor the application for errors and unusual activity. If we confirm a security incident that affects customer data, we investigate and contain it, and notify affected customers without undue delay and as required by law.
Payment and card-data boundary
Stripe remains the card-data processor. Trades Operator does not store raw card numbers. The app stores payment status, refund and dispute history, payout proof, and matching status for the right company.
AI and customer actions
Operator AI can summarize, rank, and draft from the contractor's own records. It should not send customer messages, charge money, schedule work, or change books without human approval.
Reporting a vulnerability
Email security@tradesoperator.com with the details and steps to reproduce. Please do not access or change other companies' data, disrupt the service, or include real customer data or passwords in your report. We act in good faith toward researchers who follow these limits, and we will acknowledge your report promptly.
Roadmap and non-claims
Trades Operator is building toward third-party review, SOC 2 evidence, access reviews, restore drills, vendor reviews, and a fuller trust center. It is not currently claiming SOC 2 certification, enterprise compliance, automatic legal compliance, or zero risk.
For account or privacy questions, contact support@tradesoperator.com.