Trust center · Written to be forwarded
Security you can verify.
Every control below is something we have actually built, described as an implemented fact rather than an enterprise adjective. Where we haven't built something, it says so.
What this page is
This page documents how Thermal isolates your data, controls access, records an audit trail, handles storage and transport, and secures the integrations you connect — as they exist in the product today. Every statement traces to code, an automated test, or the way the product is configured in production. Anything unbuilt is marked on the roadmap, never written as though it were live.
It's addressed to whoever on your side has to sign off — IT, the ops director, or the controller. You should be able to forward this URL without writing a covering note first.
The control register.
Five areas, nineteen controls, and how each one is actually enforced. Where a control is a database or server-side guarantee rather than a UI behavior, the middle column says so — that distinction is usually the question being asked.
| Control | How it's enforced | Status |
|---|---|---|
| 01Tenant & branch isolation | ||
| Row-level security, not app logic | A database session scoped to one organization cannot read or write another organization's rows. Postgres enforces it, independent of the application code doing the querying. | Live |
| Branch-level restriction | Inside one multi-branch organization a role can be restricted to its own branches. An unrestricted session — owner, dispatch-all, scheduled jobs — sees every branch by default. | Live |
| Isolation is tested, not assumed | An automated cross-organization and cross-branch deny test runs against the real restricted database role, so the boundary is proven rather than documented. | Live |
| 02Access & approvals | ||
| Four fixed roles | Owner, dispatcher, office, technician — checked server-side against a fixed role matrix at the server-component and server-action layer, not hidden by the interface. A technician sees only their assigned jobs. | Live |
| Dollar-based approval rules | Discount percentages, purchase-order amounts and refunds above a configured threshold require approval — enforced server-side on the transition, not flagged in the UI after the fact. | Live |
| API keys hashed and revocable | A programmatic key is prefixed and hashed before storage, never kept in plaintext. It can carry an expiry and be revoked individually at any time. | Live |
| Custom roles and SSO | Not available. Sign-in runs through email and password or a one-time code, across the four fixed roles above. Configurable roles and single sign-on are on the roadmap, not built. | On the roadmap |
| 03Auditability | ||
| Append-only event ledger | Creates, status changes, completions and deletes on customers, sites, equipment, agreements, work orders and invoices each write an event in the same transaction as the change. The event commits only if the change does. | Live |
| Org-wide audit log and export | An owner can browse the full event history filtered by actor, action, entity, branch and date, and export it as CSV or JSON from Settings. | Live |
| Automated actions labeled distinctly | An event records whether it was taken by a person, an automated system process, or an agent action. An automated change is never indistinguishable from a human one in the trail — the oversight model behind that is on the automation page. | Live |
| 04Data handling | ||
| Hosting | Vercel for the application, Supabase for managed Postgres. Established infrastructure providers, not servers in someone's cupboard. | Live |
| Encrypted in transit | Every response is served over HTTPS with HTTP Strict Transport Security enforced, plus frame protection, content-type sniffing protection and a restrictive permissions policy. | Live |
| Secrets encrypted at rest | Integration credentials and webhook secrets are encrypted with AES-256-GCM before storage. Never saved in plaintext. | Live |
| Full export, any time | An owner can request a complete export from Settings — customers, sites, equipment, service history, agreements, work orders, invoices, warranty claims — as a downloadable archive. Your data remains yours. | Live |
| Exports don't linger | A generated export link is retained for seven days. The underlying file is deleted automatically once it expires. | Live |
| 05Integrations & API | ||
| Outbound webhooks are signed | Every webhook Thermal sends is signed with HMAC-SHA256 using a per-endpoint secret, so your receiving endpoint can verify the payload came from us. | Live |
| Webhook destinations are checked | An outbound URL must be HTTPS and is checked against private and internal network ranges — both the literal address and the DNS-resolved one — before Thermal will send to it. | Live |
| Inbound webhooks are verified | Webhooks received from connected providers — payments, telephony, and the accounting integrations — are signature-verified before processing. An unsigned or invalid request is rejected. | Live |
| Durable, identity-scoped rate limits | Requests are limited against a durable shared store rather than an in-memory counter that resets on restart, keyed to the calling identity wherever a request carries one. | Live |
If a control you need isn't in this register, the honest answer is that we haven't built it. Ask and we'll tell you which — see the gaps below for the ones we already know you'll ask about.
What we haven't built.
Most vendors handle this section by not having one. If any of these four is a hard requirement, you'll find out now rather than in week six of an evaluation.
No certifications
Thermal does not hold SOC 2, ISO 27001, HIPAA or PCI DSS, and there's no badge on this page implying otherwise. Not a pending audit, not a target date. If a certification is a gate for you, say so early and we'll give you the current answer rather than a timeline we can't stand behind.
No SSO, no custom roles
Sign-in is email and password or a one-time code. Access is the four fixed roles — owner, dispatcher, office, technician. Configurable roles and single sign-on are on the roadmap and tracked on the public roadmap board.
No published backup SLA
The database runs on Supabase's managed Postgres. We haven't published a specific backup interval or retention commitment, and that's a gap rather than a hidden fact. What we can offer today is the full export above — your own copy, outside our systems, whenever you want it.
No customer references yet
There's no logo wall on this site because we don't have one worth showing. The controls in the register are verifiable on their own terms — in a demo we'll show you the audit log and the export running against real records rather than a slide.
Everything in the register is a fact about the product. Everything in this section is a fact about its limits. Both are on the page for the same reason.
The six questions, each with its own page.
Procurement rarely forwards a whole trust page — they forward one answer. Each of these has its own URL so it can be sent on its own, and so an answer engine can cite it directly.
Is my data isolated from other tenants?
Yes. Every organization's records are isolated at the database level by Postgres row-level security, not just application code — a session scoped to one organization cannot read or write another organization's rows. This is proven by an automated cross-organization deny test that runs against the real database role, not just asserted in application code.
Open this answer on its own page/security/is-my-data-isolated-from-other-tenants
What happens to my data if I leave?
Any organization owner can generate a full export of their organization's data at any time from Settings — customers, sites, equipment, service history, agreements, work orders, invoices, and warranty claims — delivered as a downloadable archive. There is no penalty exit clause and no export ransom.
Open this answer on its own page/security/what-happens-to-my-data-if-i-leave
Do you support SSO?
Not yet. Sign-in today runs through email/password or a one-time code, across four fixed roles (owner, dispatcher, office, technician). Single sign-on and custom/configurable roles are on the roadmap, not available today.
Open this answer on its own page/security/do-you-support-sso
How is my data backed up?
Thermal's database runs on Supabase's managed Postgres infrastructure. We haven't published a specific backup interval or retention commitment yet. If you want a copy of your own data outside our systems at any time, any organization owner can generate a full export from Settings — see "What happens to my data if I leave" above.
Open this answer on its own page/security/how-is-my-data-backed-up
Who can see my data internally?
Access is role-based and enforced server-side, not just hidden in the UI — the four roles above define what a user can see and do. Every action on the core records is written to an append-only event ledger, and an organization owner can browse and export the full history for their organization at any time.
Open this answer on its own page/security/who-can-see-my-data-internally
Do you have SOC 2?
No. Thermal does not currently hold SOC 2, ISO 27001, HIPAA, or PCI DSS certification, and we don't claim any of them. This page describes the controls we've actually built, not a pending audit or a roadmap promise.
Open this answer on its own page/security/do-you-have-soc-2
Bring your security questionnaire.
The real one, with the rows that don't apply to a field-service product still in it. We'll fill it in on the call and mark the gaps as gaps. You can also read how records get in and out on migration.