Security & privacy
Your customers' data, locked down.
How we keep your business walled off, your payments safe and your crews' locations private.
Every business walled offEach rental business is isolated from every other one in the database itself, not just in the screens. Tested on every release.
Card data never touches usPayments run through Stripe’s hosted fields and your own Stripe account. Stripe is PCI DSS Level 1 certified.
Encrypted everywhereTLS for everything in transit. Data, mail passwords and API keys are encrypted at rest and never shown again.
Passkeys & two-step sign-inModern sign-in for owners and staff, with roles that limit what each person can see.
Full audit logEvery change to an order, payment, checklist or setting is recorded with who and when.
GPS only on the jobCrew location is shared only while en route to an assigned job, and deleted after 90 days.
Backups & recoveryNightly backups, stored separately from the live database.
Your data, your exitExport customers, orders and payments to CSV any time. Close your account and we delete it on request.
Who else touches your data
| Sub-processor | What for | Where |
|---|---|---|
| Vercel | Application hosting | United States |
| Supabase | Database and backups | United States (Oregon) |
| Railway | Scheduled jobs: reminders and balance charges | United States |
| Cloudflare R2 | File storage (logos, photos, documents) and backups | United States |
| Stripe | Card payments and payouts | United States |
| Mapbox | Driving distances and maps | United States |
| Your SMS provider | Text messages, from your own account | Your choice |
Found a security issue? Email security@renthatch.org. We reply within 2 business days and won't take action against good-faith research.Privacy policyData processing agreement