Your customers’ data stays your company’s.
Encrypted in transit and at rest, walled off per company at the database, and hosted in the US. Quotes, payments, and crew timesheets included.
Built on Vercel, Supabase, AWS us-east, Sentry, Upstash.
Security spec
- Traffic on TLS 1.3
- 100%
- Encryption at rest
- AES-256
- Tenant isolation
- At the database
- Crew location off the clock
- Never
- Breaches to date
- None
- Breach notification
- Within 24 hours
One path for every request.
A quote lookup, a card payment, and a crew clock-in all take the same route. No back doors, and no cheaper plan with weaker defaults.
01
Browser
TLS 1.3
02
Vercel Edge
rate-limited
03
Next.js Server
auth, RBAC
04
Supabase, RLS
AES-256 at rest
05
Cross-region backup
AWS us-west
- In flight
- TLS 1.3, HSTS preload, no TLS 1.2 fallback.
- In process
- Row-level security and server-side keys on every table.
- At rest
- AES-256 on every row and attachment, backed up to a second region.
01
02
03
We don’t track your crew off the clock.
Location proves someone was on the job, and on Pro and Scale the live crew map helps the office dispatch during the workday. Once a crew clocks out, we don’t know where they are, and we aren’t asking.
Recorded
- Clock-inOne location fix, verified against the job address.
- Clock-outOne fix, when the crew finishes or leaves.
- Job-site photoOne fix, attached to the photo record itself.
- Live crew mapOn Pro and Scale, crew location while on the clock, so the office can dispatch.
Never recorded
- Driving telemetryWe are not a fleet tool. No braking events.
- Off-the-clock locationThe phone is not reporting once a crew clocks out.
From the first clock-in to the day you leave.
No hidden copies, no secret retention.
01
Capture
Clock-ins, photos, quotes, and payments arrive over TLS 1.3. The server signs and timestamps every event before anything is stored.
02
Encrypt
Data is written through row-level security into an AES-256 at-rest volume. Attachments are encrypted before storage hands the upload back.
03
Replicate
Point-in-time snapshots and daily backups are copied to a second region. A backup that cannot restore is not a backup, so we test them.
04
Export
Export your customer, job, and payment data as CSV or JSON at any time. No support ticket, no retention bait.
05
Delete
Account closure triggers a 30-day hold, then a permanent purge across primary, replica, and backups. We publish the clock, we don't hide it.
What we don’t have yet.
Better you read it here than find it in a vendor review.
SSO / SAML
Enterprise planSSO and SAML are part of the Enterprise plan, not Starter, Pro, or Scale. If you need it, talk to sales.
SOC 2 Type II
In progress, not yet auditedControls are designed against SOC 2, but we have not yet completed a Type II audit. Email security@revcorepro.com for our internal controls letter.
Custom-domain portal
RoadmapEvery plan puts your logo and colors on the homeowner portal, and Scale makes it fully white-label. A fully custom domain on the homeowner portal is on the roadmap.
24/7 incident hotline
Email-first, business hourssecurity@revcorepro.com is monitored during weekday business hours, with an after-hours pager rotation for confirmed priority-one incidents.
We acknowledge reports within one business day, with a 90-day coordinated disclosure window. See also the status page.
Common questions, plainly answered.
Still deciding if Revcore fits your crew? Talk to our team.
Is Revcore Pro SOC 2 certified?
A SOC 2 Type II audit is in progress, with our controls mapped to the Trust Services Criteria. Email security@revcorepro.com for our current controls letter while the audit completes.
Where is customer data stored?
In the United States. Vercel edge plus Supabase on AWS us-east, with cross-region backups. No data is transferred abroad without your direction.
Has Revcore Pro had a security breach?
No breaches to date. If a material incident ever occurs, affected customers are notified within 24 hours in plain English.
How does Revcore Pro handle crew GPS and location?
We capture location at clock-in, clock-out, and on job-site photos, to prove presence. On Pro and Scale, the live crew map also shows where crews are while they are on the clock, so the office can dispatch. There is no driving telemetry and no location reporting once a crew clocks out.
Who at Revcore Pro can access my data?
Access is row-level and role-scoped. Service-role keys are held server-side only, and every privileged operation is logged. Internal access is least-privilege and reviewed.
Can I export my data? Can I delete it?
Yes to both. Export customers, jobs, and payments as CSV or JSON anytime. Account closure triggers a 30-day hold, then a permanent purge across primary, replica, and backups.
