Your customers’ data stays your company’s.
Encrypted in transit and at rest, walled off per company at the database, and hosted in the US. Quotes, payments, and crew timesheets included.
Built on Vercel, Supabase, AWS us-east, Stripe, Sentry, Upstash.
Security spec
- Traffic on TLS 1.3
- 100%
- Encryption at rest
- AES-256
- Tenant isolation
- At the database
- Continuous GPS on crews
- Never
- Breaches to date
- None
- Breach notification
- Within 24 hours
One path for every request.
A quote lookup, a card payment, and a crew clock-in all take the same route. No back doors, and no cheaper plan with weaker defaults.
01
Browser
TLS 1.3
02
Vercel Edge
rate-limited
03
Next.js Server
auth, RBAC
04
Supabase, RLS
AES-256 at rest
05
Cross-region backup
AWS us-west
- In flight
- TLS 1.3, HSTS preload, no TLS 1.2 fallback.
- In process
- Row-level security and server-side keys on every table.
- At rest
- AES-256 on every row and attachment, backed up to a second region.
01
02
03
We don’t track your crew.
On Pro and Scale, location is taken at three moments to prove someone was on the job. The rest of the day, we don’t know where your crew is, and we aren’t asking.
Recorded
- Clock-inOne location fix, verified against the job address.
- Clock-outOne fix, when the crew finishes or leaves.
- Job-site photoOne fix, attached to the photo record itself.
Never recorded
- Live-location mapNot streamed, not stored, not rendered.
- Driving telemetryWe are not a fleet tool. No braking events.
- Background locationThe phone is not reporting when off the job.
From the first clock-in to the day you leave.
No hidden copies, no secret retention.
01
Capture
Clock-ins, photos, quotes, and payments arrive over TLS 1.3. The server signs and timestamps every event before anything is stored.
02
Encrypt
Data is written through row-level security into an AES-256 at-rest volume. Attachments are encrypted before storage hands the upload back.
03
Replicate
Point-in-time snapshots and daily backups are copied to a second region. A backup that cannot restore is not a backup, so we test them.
04
Export
Export your customer, job, and payment data as CSV or JSON at any time. No support ticket, no retention bait.
05
Delete
Account closure triggers a 30-day hold, then a permanent purge across primary, replica, and backups. We publish the clock, we don't hide it.
What we don’t have yet.
Better you read it here than find it in a vendor review.
SSO / SAML
On the roadmapNo tenant-side SSO or SAML today. Enterprise SSO through Okta or Google Workspace is on the roadmap. If you need it, talk to sales.
SOC 2 Type II
In progress, not yet auditedControls are designed against SOC 2, but we have not yet completed a Type II audit. Email security@revcorepro.com for our internal controls letter.
Custom-domain portal
RoadmapThe Scale plan supports a white-label portal with your logo and brand color today. A fully custom domain on the homeowner portal is on the roadmap.
24/7 incident hotline
Email-first, business hourssecurity@revcorepro.com is monitored during weekday business hours, with an after-hours pager rotation for confirmed priority-one incidents.
We acknowledge reports within one business day, with a 90-day coordinated disclosure window. See also the status page.
Common questions, plainly answered.
Still deciding if Revcore fits your crew? Talk to our team.
Is Revcore Pro SOC 2 certified?
A SOC 2 Type II audit is in progress, with our controls mapped to the Trust Services Criteria. Email security@revcorepro.com for our current controls letter while the audit completes.
Where is customer data stored?
In the United States. Vercel edge plus Supabase on AWS us-east, with cross-region backups. No data is transferred abroad without your direction.
Has Revcore Pro had a security breach?
No breaches to date. If a material incident ever occurs, affected customers are notified within 24 hours in plain English.
How does Revcore Pro handle crew GPS and location?
We capture location at exactly three crew events, clock-in, clock-out, and job-site photos, to prove presence. There is no live-location map, no driving telemetry, and no background tracking.
Who at Revcore Pro can access my data?
Access is row-level and role-scoped. Service-role keys are held server-side only, and every privileged operation is logged. Internal access is least-privilege and reviewed.
Can I export my data? Can I delete it?
Yes to both. Export customers, jobs, and payments as CSV or JSON anytime. Account closure triggers a 30-day hold, then a permanent purge across primary, replica, and backups.
