Security

Your books, your rules.

An honest inventory of what is true today — role- and project-scoped access, an audit trail from the document workflow, and your choice of where the data lives. What is not yet true, we say plainly.

Book a walkthrough
01Permissions

Role- and project-scoped access.

Access is scoped two ways at once: by role and by project. A foreman signs in and sees only his own jobs — his crew’s timecards, his daily reports — not the company’s payroll or another PM’s budgets.

Payroll, AR, AP and job cost each have their own permission surface, so the person who enters field hours is not the person who can see gross wages or cut a check.

02Audit trail

Draft, submit, and a record of who did what.

Financial documents move through a draft-then-submit workflow. A submitted invoice, pay run or journal entry is locked; changing it means a tracked amendment or cancellation, not a silent edit.

That workflow is the audit trail. Every submit, amend and cancel is attributable — the record a controller needs when a GC, an auditor or the DLSE asks how a number came to be.

03Data location

Self-host or managed cloud — your call.

Where your books live is a decision you get to make. Run the system as managed cloud and let us operate it, or self-host on your own infrastructure and keep the data inside your own walls.

The application is the same either way. Hosting is a deployment choice, not a different product with features held back.

04Open platform

Built on the Frappe open-source platform — no black box.

The system is built on the Frappe open-source platform. The data model is inspectable, the database is a standard one you can query directly, and you are not locked inside a proprietary format you can never get back out of. Your data stays legible to you.

05Roadmap

What isn't true yet — said plainly.

We will not put a badge on this page that we have not earned.

A formal SOC 2 attestation is on the roadmap for the productized offering — it is not in place today, so we do not claim it. When it exists, it will be a real report you can read, not a logo. Anything else on the roadmap gets the same treatment: stated as a plan, never as a fact.

06FAQ

Security questions.

How are backups handled?
On managed cloud we run regular automated backups of the database and files. Self-hosted, you own the backup schedule on your own infrastructure — and because it is a standard database, it fits the backup tooling you already run.
Can we get our data out?
Always. It is your data, in a standard SQL database. You can export it in standard formats and, on self-host, query the database directly. There is no proprietary lock-in on the way out.
Who can see payroll data?
Only the roles you grant it to. Payroll figures — gross wages, garnishments, benefit amounts — sit behind their own permission scope, separate from the field and project-management views. A foreman entering hours never sees pay.
Is there an on-prem option?
Yes. You can self-host the whole system on your own servers, so the books and payroll data never leave your infrastructure. Managed cloud is offered for contractors who would rather not run it themselves.

Bring your security requirements to the walkthrough.

Self-host or cloud, your permission model, your audit needs — we will walk through exactly how the system handles each.

Book a walkthrough

45 minutes on your real workflows.