Security & trust
The walls are in the database.
Company-scoped data behind Row-Level Security, card handling delegated to the processor, and trust documentation a buyer can review before rollout.
The posture
- Row-Level Security on every tableTenant isolation at the database engine, not the application layer.Enforced
- Encryption in transit and at restHTTPS/TLS on the wire; managed-provider encryption for sensitive data.Required
- Cardholder dataRaw card handling delegated to the payment processor.Delegated
- SOC 2 readinessControls mapped to the Trust Services Criteria.In progress
Tenant isolation
One company. One set of rows.
Isolation is enforced where it cannot be forgotten: at the database engine, on every table, for every query.
01
A company_id on every table
Every table that stores business data is scoped to the company record. No shared table mixes tenants without strict filtering.
02
The database enforces it
RLS policies live in PostgreSQL. A query that would return another company's rows is rejected at the engine, before any results exist.
03
Defense in depth
An application bug, a misconfigured query, or a compromised dependency hits the same wall: the policy blocks it.
04
The service role stays server-side
The key that bypasses RLS lives only in server-side environment configuration. It is never in a client bundle or an API response.
Sign-in and roles
Who gets in, and what they see.
Sessions expire
Supabase Auth issues JWTs with a one-hour expiry. Refresh tokens rotate: each use issues a new token and invalidates the old one.
Cookies, not localStorage
Session tokens are stored in httpOnly, Secure, SameSite=Lax cookies.
Passwords are hashed
bcrypt, never plaintext. Magic link and OAuth with Google or Microsoft are there if you would rather not have a password at all.
Five roles, narrowly scoped
Owner, Admin, Dispatcher, Technician, View-Only. A technician sees the job, the schedule, and the customer's contact details, not payment methods, invoice amounts, or financial reports.
Money and messages
The wires out of the building.
Cards
Field payment workflows delegate raw card handling to the configured payment processor. Thorbis keeps payment references and audit records, not card numbers.
Payment webhooks
Incoming payment events are expected to be signed: an unsigned or incorrectly signed event is rejected before processing.
Texts
Outbound SMS runs on A2P 10DLC registration. STOP, HELP, and CANCEL are handled automatically, and opt-outs are honored as TCPA requires.
Email
Sending domains authenticate with DKIM, SPF restricts authorized servers, and DMARC policy is configurable.
Customer portal links
Time-limited signed tokens: a 72-hour expiry by default, and nothing sensitive in the URL.
Held back
What this page will not claim.
No SOC 2 badge before the report. Controls are mapped to the Trust Services Criteria; confirm report availability during security review before procurement relies on it.
No raw card numbers. Cardholder data lives with the payment processor. Thorbis retains tokens, references, and audit records.
No guessed answers on data residency. Storage questions are answered in the review packet, where the answer depends on configuration, not on marketing.
No selling personal data. Privacy-request handling is documented for the buyers whose legal teams need to check.
When something breaks
Detection has a clock.
0–15 min
P1 · Security incident
Automated detection and an on-call alert. Triage the scope, contain the access path, preserve evidence, and notify affected customers when impact is confirmed and legally required.
0–30 min
P2 · Full outage
An incident opens on the status page and stays updated as the investigation progresses, with a post-incident summary when customer impact warrants one.
0–1 hour
P3 · Degraded performance
Investigated on detection, logged to the status page when the impact is material, and closed when performance returns to normal.
Found a vulnerability? Email security@thorbis.com with the details. Reports triage through the same incident process, and good-faith coordinated disclosure is welcome.
The people
Employees are inside the walls too.
MFA, everywhere
Required for all employee accounts, with SSO enforced for internal tooling.
Least privilege
Production access requires explicit approval, and an offboarding checklist revokes it.
Access is logged
Administrative access to production data records the employee, the timestamp, and the action, retained for 12 months and available for review.
Support sees what you show it
Employee access to customer data requires an active support session you initiated, or an escalation you approved.
Review
Proof before rollout.
Questionnaires, subprocessor lists, data-flow notes, and NDA documentation start with security@thorbis.com. A person answers.
Waitlist open. One email when your invite is ready, nothing else.
Coming from a suite? We’ll extract your records.