Security
Securityyou can verify.
Tenant data is isolated in the database, access runs on four fixed roles checked server-side, every change is written to an append-only ledger, and an owner can export everything at any time.
Six questions.
The controlregister.
Tenant isolation and access
Row-level security, not app logicA database session scoped to one organization cannot read or write another organization's rows. Postgres enforces it, independent of the application code doing the querying.
Branch-level restrictionIn one multi-branch organization a role can be restricted to its own branches. An unrestricted session (owner, dispatch-all, scheduled jobs) sees every branch by default.
Isolation is tested, not assumedAn automated cross-organization and cross-branch deny test runs against the real restricted database role, so the boundary is proven rather than documented.
Four fixed rolesOwner, dispatcher, office, technician, checked server-side against a fixed role matrix, not hidden by the interface. A technician sees only their assigned jobs.
Dollar-based approval rulesDiscount percentages, purchase-order amounts and refunds above a configured threshold require approval, enforced server-side on the transition rather than flagged in the interface after the fact.
API keys hashed and revocableA programmatic key is prefixed and hashed before storage, never kept in plaintext. It can carry an expiry and be revoked individually at any time.
Custom roles and SSONot available. Sign-in runs through email and password or a one-time code, across the four fixed roles. Configurable roles and single sign-on are on the roadmap, not built.
Audit trail
Append-only event ledgerCreates, status changes, completions and deletes on customers, sites, equipment, agreements, work orders and invoices each write an event in the same transaction as the change. The event commits only if the change does.
Org-wide audit log and exportAn owner can browse the full event history filtered by actor, action, entity, branch and date, and export it as CSV or JSON from Settings.
Automated actions labeled distinctlyAn event records whether it was taken by a person, an automated system process or an automated action. An automated change is never indistinguishable from a human one in the trail. The oversight model behind that is on the automation page.
Storage and transport
HostingVercel for the application, Supabase for managed Postgres.
Encrypted in transitEvery response is served over HTTPS with HTTP Strict Transport Security enforced, plus frame protection, content-type sniffing protection and a restrictive permissions policy.
Secrets encrypted at restIntegration credentials and webhook secrets are encrypted with AES-256-GCM before storage. Never saved in plaintext.
Your data
Full export, any timeAn owner can request a complete export from Settings (customers, sites, equipment, service history, agreements, work orders, invoices, warranty claims) as a downloadable archive. Your data remains yours.
Exports don't lingerA generated export link is retained for seven days. The underlying file is deleted automatically once it expires.
Data-processing providers, namedA small set of automation features send data to named processing providers. Each provider, and exactly what it receives, is listed on the privacy page.
- Anthropic — drafts suggested customer-service replies and grounded help answers over your account's own documentation excerpts.
- OpenAI — reads equipment nameplate photos and helps match spreadsheet columns during data import.
- Google Gemini — triages inbound call details and other structured product automation tasks.
- Zai — is a failover provider for the same product automation tasks listed above.
- DeepSeek — handles internal, non-customer tasks only: it checks our public changelog before it is published, reading the planned and written entries, the titles, descriptions and changed file names of our own merged code changes, recently published entries, and the titles of the public roadmap ideas an entry links to; and it reviews some proposed changes to our own source code. It never receives your organization's Customer Data. Reached only through our Cloudflare gateway, never called directly.
Integrations and webhooks
Outbound webhooks are signedEvery webhook Thermal sends is signed with HMAC-SHA256 using a per-endpoint secret, so your receiving endpoint can verify the payload came from us.
Webhook destinations are checkedAn outbound URL must be HTTPS and is checked against private and internal network ranges, both the literal address and the DNS-resolved one, before Thermal will send to it.
Inbound webhooks are verifiedWebhooks received from connected providers (payments, telephony and the accounting integrations) are signature-verified before processing. An unsigned or invalid request is rejected.
Durable, identity-scoped rate limitsRequests are limited against a durable shared store rather than an in-memory counter that resets on restart, keyed to the calling identity wherever a request carries one.
Four limits.
- Certifications
- Thermal does not currently hold SOC 2, ISO 27001, HIPAA or PCI DSS. It is not a pending audit and there is no target date. If a certification is a gate for you, say so early.
- SSO and custom roles
- Sign-in is email and password or a one-time code, across four fixed roles. Single sign-on and configurable roles are on the roadmap, not built.
- Backup commitment
- The database runs on Supabase’s managed Postgres. A backup interval or retention commitment has not been published. The full export is your own copy, whenever you want it.
- Customer references
- There are none to show yet. The controls can be checked on their own terms: in a demo, the audit log and the export run against real records.