Your rates don't leave the yard.

A contractor's rate sheet is a competitive secret, and a PO value tells a competitor what a job was worth. Isolation between companies is the property we guard hardest.

Your company is written into your session by our servers at sign-in and never taken from a request. Changing an ID in a URL doesn't change who you are: every route looks up who owns a record in the database before it returns or changes anything. Browsers can't read or write the database directly; every request goes through the server, which checks your company and your role first.

Inside a company, roles decide what reaches the screen. Foremen and operators build tickets from a rate sheet they never see: the server doesn't send them rates, line totals, invoices or budget figures, so there is nothing to screenshot and nothing to take to a competitor. The help assistant follows the same rule. Clients see the money they're approving, and nothing of anyone else's.

When a ticket is signed we hash its commercial facts (lines, quantities, rates, total) and freeze the PDF. Both are stored with the signature. If anything changes afterwards, a freshly computed hash no longer matches and our integrity checks flag it.

Every signed document carries a QR code to a public verification page showing the frozen snapshot: the total as signed, not as it stands today. Anyone holding a printed copy can check it without an account.

No route in the system edits or deletes a signature. A client who approves in error posts a reversal: a new, audited record. The original approval stays on file.

Clients can approve a ticket from a link, without an account. Those links carry prices, so only a company's owners and admins can send one, and never to someone inside their own company.

Each link is a long random token. We store only its hash, so even a copy of our database can't be turned back into working links. Links expire after 72 hours, and sending a new one for a ticket shuts the old one off.

Sign in with email and password, or with your company's Microsoft or Google account (see single sign-on, below). Two-factor sign-in uses an authenticator app, which works with no signal: a foreman at the end of a haul road isn't locked out because he can't receive a text.

Sessions are server-issued, httpOnly, secure cookies, re-verified on every request. Suspend or remove someone and they're signed out everywhere, immediately, and stop receiving emails and texts. Not when a token runs out.

Our own administration console sits behind an allowlist, an active staff record and two-factor sign-in.

Your office and crews can sign in with the work accounts they already have: Microsoft 365 (Entra ID) or Google Workspace. No separate Pit & Rig password to create, reuse or forget.

Your IT department's rules come with it. The sign-in happens at Microsoft or Google, so your own multi-factor requirements, conditional access and password policies run before the request ever reaches us. We receive a verified identity, never a password.

A work account on its own opens nothing. Nobody joins your company in Pit & Rig until someone in it has invited that address.

When someone leaves, disabling their Microsoft or Google account stops them signing in again. To end a session that's already open, suspend or remove them in Pit & Rig: that signs them out everywhere at once. No session lasts longer than five days.

Money is stored as integer cents. There is no floating-point path in pricing, totals or tax, and inputs are checked against strict formats that reject negative charges, scientific notation and fractions of a cent.

Approvals, invoicing and budget drawdown run inside database transactions that re-read before they write. Two people approving the same ticket at the same moment get one approval and one refusal, never a double count.

An owner can soft-close a month (overrides need a recorded reason), then hard-lock it. A locked month has no override path for anyone, including us.

Every change that matters goes in an audit trail: who made it, when, what it was before and after, and where the request came from.

The database, sign-in and file storage run on Google Firebase. The database is in Google Cloud's United States multi-region. The application is hosted on Vercel. Data is encrypted in transit (TLS) and at rest by those providers.

The database is backed up every day and each backup is kept for 8 weeks. Point-in-time recovery lets us restore it to any moment in the last 7 days, and delete protection stops the database itself from being removed by mistake.

If you stop paying, nothing disappears overnight: your records stay readable and exportable for 90 days before they become eligible for deletion.

Payments go through Stripe. We never see or store a card number.

HTTPS is enforced on every page, a content security policy limits what pages can load, and no other site can frame ours to trick a click.

Uploaded photos and signatures are identified by their contents, never by their file name, and are refused if they declare an image too large to process safely.

Crew sign-on codes, invitations and contact forms are rate-limited across every one of our servers, so spreading guesses across many requests doesn't get around the limit.

Our test suite is written to break things. It fails the build if a route reads a field nobody writes, if a financial control is enforced on one path and missing from another, if two pieces of code that compute money drift apart, or if a storage rule grants access on sign-in alone rather than ownership.

Before launch, every area of the application was reviewed on the assumption that it was broken. Each issue found was confirmed by a second reviewer, fixed, re-checked and covered by a test so it can't quietly come back.

No SOC 2 or ISO 27001 certification. We're a small company and haven't been through that audit. If your procurement process requires one, tell us; it changes our priorities.

No SAML or OpenID Connect connections to other identity providers (Okta, Ping, ADFS) yet, no automatic user provisioning (SCIM), and a company can't yet require single sign-on for all its users. Microsoft and Google sign-in work today. Until Microsoft finishes verifying us as a publisher, some company tenants need their IT admin to approve the app once. SAML is on the roadmap and the platform we sign in through supports it; if you need it, tell us.

No Canadian data residency option yet. Your data is stored in the United States, as above. If you need it held in Canada, tell us.