Loading...
Built for HVAC, plumbing, electrical, and recurring service teams.
Open betaUnlimited users. Pricing from $200/month.
Built for HVAC, plumbing, electrical, and recurring service teams.
Loading...
Thorbis was designed with security at its core. From encrypted data storage to rigorous compliance programs, we protect sensitive information for contractors of every size.
Thorbis runs on Supabase PostgreSQL and Vercel Edge Network — battle-tested managed infrastructure that handles security patching, redundancy, and compliance certifications so we can focus on the application layer.
We use Supabase Auth for all authentication flows, with short-lived tokens, secure cookie storage, and role-based access controls scoped to your company.
JWT tokens with short expiry
Supabase Auth issues JWTs with a 1-hour expiry. Refresh token rotation is enabled — each use issues a new token and invalidates the old one, limiting the window for stolen token abuse.
Multiple authentication methods
Email/password with bcrypt hashing, magic link (passwordless email), and OAuth providers (Google, Microsoft). Passwords are never stored in plaintext.
HttpOnly secure cookies
Session tokens are stored in httpOnly, Secure, SameSite=Lax cookies — not localStorage. This prevents JavaScript from reading the token, blocking the most common XSS token theft vector.
Role-based access control (RBAC)
Five built-in roles: Owner, Admin, Dispatcher, Technician, and View-Only. Each role has a narrowly scoped permission set. Technicians cannot access financial data or customer payment methods.
Row-Level Security on every query
Every Supabase query is automatically scoped to the authenticated user's company_id via RLS policies. Even if application code contained a bug, the database engine would reject cross-tenant queries.
Service role key never exposed to clients
The Supabase service role key (which bypasses RLS) is stored only in server-side environment variables and is never included in client-side bundles or API responses.
Your data is never commingled with another company's data. Isolation is enforced at the database engine level — not just by application code.
Company-scoped at the schema level
Every table that stores business data includes a company_id column. There is no shared table that mixes data from different tenants without strict filtering.
Database-enforced, not application-enforced
RLS policies are defined directly in PostgreSQL. The application layer cannot issue a query that returns another company's data — the database rejects it at the engine level before any results are returned.
Defense in depth
Even if an application bug, misconfigured query, or compromised dependency attempted to access cross-tenant data, the RLS policy would block it. Isolation does not depend on a single layer being correct.
Supabase service role access is restricted
Only background workers that require privileged access (such as migration scripts and scheduled jobs) use the service role. All user-facing API routes use the authenticated client, which is subject to full RLS enforcement.
Thorbis never stores, processes, or transmits raw card numbers. All payment data is handled by PCI DSS Level 1 certified processors.
SMS and email sent through Thorbis are authenticated, compliant, and protected against spoofing. Customer portal links use short-lived signed tokens.
We align with the compliance frameworks that matter to field service contractors — from SOC 2 and GDPR to TCPA and PCI DSS.
SOC 2 Type II
Audit in progressSecurity controls are aligned to the SOC 2 Trust Services Criteria. The formal Type II audit is underway; the report is expected Q4 2025 and will be available under NDA upon request.
GDPR
CompliantData Processing Agreements (DPAs) are available for all customers. EU Standard Contractual Clauses (SCCs) govern any data transferred outside the EU. Data subject requests (access, deletion, portability) are fulfilled within 30 days. EU data residency is available upon request.
CCPA
CompliantCalifornia consumers have the right to know, delete, and opt out of the sale of their personal information. Thorbis does not sell personal data. Data deletion requests are processed within 45 days.
TCPA (SMS)
CompliantAll SMS campaigns require prior express written consent. STOP/HELP/CANCEL auto-responses are enabled by default. Opt-outs are honored within 24 hours. Message frequency disclosures are included in opt-in confirmations.
PCI DSS
Delegated to processorsThorbis delegates all cardholder data handling to Payrix (field payments) and Stripe (subscriptions), both of which hold Level 1 PCI DSS certification. Thorbis itself is a SAQ-A merchant and does not store, process, or transmit cardholder data.
Annual penetration testing
ActiveIndependent third-party penetration tests and vulnerability assessments are performed annually. Findings are remediated on a risk-prioritized schedule. Executive summaries are available under NDA.
Employee security controls
We define three severity tiers with documented response times, communication requirements, and postmortem obligations. Security issues can be reported to security@thorbis.com.
Data breach / security incident
Full service outage
Degraded performance
Report a security vulnerability
Email security@thorbis.com with details. We acknowledge all reports within 24 hours and follow a coordinated disclosure process. We do not pursue legal action against researchers acting in good faith.
Our security team can complete questionnaires, provide documentation under NDA, or schedule a technical review call for enterprise prospects.