Security
Do you have SOC 2?
No. Thermal does not currently hold SOC 2, ISO 27001, HIPAA or PCI DSS certification, and does not claim any of them.
What that rests on
Row-level security, not app logicA database session scoped to one organization cannot read or write another organization's rows. Postgres enforces it, independent of the application code doing the querying.
Append-only event ledgerCreates, status changes, completions and deletes on customers, sites, equipment, agreements, work orders and invoices each write an event in the same transaction as the change. The event commits only if the change does.
Org-wide audit log and exportAn owner can browse the full event history filtered by actor, action, entity, branch and date, and export it as CSV or JSON from Settings.