Legal

Security

Effective August 25, 2026

This page covers how we protect your data day to day. Short version: HTTPS everywhere, an encrypted database, one isolated workspace per shop, point-in-time recovery, and least-privilege access held by one operator. We describe only controls we actually run, and we say where we fall short. Report a vulnerability to sean@trusspath.com — we aim to acknowledge within 2 business days.

1. Data isolation

Every TrussPath customer lives inside a workspace (also called a tenant). Every row in the database — customer, job, estimate, invoice, employee, time entry — is tagged with atenant_id column, and every API request checks that column against your session before returning or writing anything. Cross-tenant queries are blocked at the application layer.

2. Encryption

In transit: All traffic to trusspath.com and our APIs is HTTPS/TLS 1.2 or higher. HTTP requests are 301-redirected to HTTPS.
At rest: The database is encrypted at rest by our provider (Neon) using AES-256. Object storage (photos, uploaded documents) is encrypted at rest by the provider.
Passwords: Stored using industry-standard salted password hashing. We never see your plaintext password.

3. Authentication

Email and password. Passwords are stored only as salted hashes, never in readable form, and are never logged or emailed.
Passwordless sign-in by emailed magic link. Links are single-use and expire 15 minutes after they are sent.
Session cookies are signed, HTTP-only, and scoped to our domain.
Sign-in, sign-up, and password-reset endpoints are rate limited per IP address, with counters held in the database so the limit holds across every server instance.
Owner and admin accounts are recommended to use a password manager.

4. Payments

TrussPath uses Stripe for payment processing. We do not store credit card numbers, CVCs, or bank account numbers on our servers. Stripe is PCI DSS Level 1 certified.

5. Infrastructure

Hosting: Vercel (U.S. regions) for the application and edge network.
Database: Neon (managed PostgreSQL, U.S. region) with continuous point-in-time recovery inside our plan retention window.
DNS + edge: Vercel, which terminates TLS and absorbs volumetric traffic at its edge network.
Source control: GitHub. Every push runs automated static security analysis, a dependency vulnerability audit, and the unit test suite.

6. Backups and disaster recovery

Neon holds a continuous write-ahead log for the production database, so we can restore to any point inside our plan retention window rather than to the last nightly snapshot. Backups are encrypted at rest by Neon. Restoring to a fresh branch is a routine Neon operation, but we have not yet run and documented a full restore drill; that is tracked as an open item rather than presented as a tested capability.

7. Access controls

TrussPath is currently built and operated by one engineer. Production database and hosting credentials are held only by him, kept in a password manager, and rotated on any suspected exposure. There are no shared or team accounts.
Inside the app, every role is scoped by our permission model, and integration connections record which user authorised them. A comprehensive administrative audit log covering every write is in progress and is not yet in place.
We follow the principle of least privilege: no one has more access than they need to do their job.

8. Monitoring and incident response

Application errors, request logs, and uptime are captured by our hosting platform and reviewed when we deploy or when something is reported. We do not yet run automated alerting on authentication anomalies. If we detect or are notified of a security incident, we'll:

Contain and investigate promptly.
Notify affected customers within 72 hours of confirming a breach that impacts their data.
Publish a post-mortem for material outages.

9. Vulnerability reporting

If you believe you've found a security vulnerability, please email sean@trusspath.com with a description and steps to reproduce. We'll acknowledge within two business days and work with you in good faith to fix and, where appropriate, credit you. Please don't test against real customer data — we'll set up a sandbox on request.

10. What we ask of you

Good security is a shared responsibility. Please:

Use a unique, strong password (a password manager helps).
Remove ex-employees from your workspace promptly.
Give people the lowest role they need to do their job — you don't need to make everyone an admin.
Report suspicious behavior to us right away.

11. Contact

Security questions or reports: sean@trusspath.com. TrussPath, LLC — Denver, Colorado.

Questions? Email sean@trusspath.com.