Security & trust

Your records deserve care.

Clear access boundaries, thoughtful data handling, and honest communication about what has been verified.

Deployment verification pending.

The concepts below describe the intended security posture. Production configuration and operational controls must be confirmed before these are treated as commitments. No SOC 2 or ISO certification is claimed.

Encryption in transit

Production deployments should use HTTPS/TLS to protect data in transit. The site’s default app link uses HTTPS. TODO: verify certificate management, redirect behavior, and TLS across all production endpoints.

Access control

The application models user roles so access can follow job responsibilities. Permissions need server-side enforcement; hiding a button is not a security boundary. TODO: verify the deployed role matrix and access tests.

Tenant boundaries

Company-scoped records are the foundation of tenant isolation. Requests must enforce company ownership before returning or changing data. TODO: review isolation tests and administrative access paths for the deployed version.

Records and recovery

Audit trails help teams review changes. They are not a claim of tamper-proof or unlimited record retention. TODO: confirm audit coverage, retention, backup encryption, restoration tests, and incident response procedures.

Responsible disclosure

Found a security concern?

Send a description and safe reproduction steps to support@turfops.tech. Do not include credentials or other customers’ data. Please obtain written authorization before any testing that accesses data or disrupts service.

TODO: confirm mailbox monitoring, response process, and authorized research scope. No bounty or response-time commitment is offered.