Security

1. Where your data lives

The CoverageOps application runs on Vercel, and its database, sign-in and file storage run on Supabase, in the United States. Every provider that receives personal information is listed in our Privacy Policy.

Data is encrypted in transit with TLS, and browsers are told to use only HTTPS for coverageops.co. Stored data and backups are encrypted at rest. Guard phone numbers are additionally encrypted field by field, and looked up through a keyed index, so the numbers themselves are never stored in readable form.

2. Keeping each company’s data separate

Each request is tied to the signed-in user’s company, and the application limits its queries for company data to that company. Automated tests in our build pipeline sign in as one company and try to read and change another’s data, and the build fails if any of them succeeds.

As a second layer, every table in the database has row-level security turned on, and the build fails if a table is ever added without it.

3. Signing in

• Managers and owners sign in with their own email address and password. There are no shared logins, and manager pages are refused to anyone who is not signed in.
• Guards sign in with a one-time code sent to their phone or email. Codes expire after 10 minutes, and repeated wrong codes lock the account until a supervisor unlocks it. A guard’s session lasts at most 24 hours, in a cookie that scripts cannot read and that is never sent from other sites.
• Roles: each user has a role (owner, manager, dispatcher, supervisor) and sees only what that role allows. Only an owner can export the company’s data.

4. Text messages

• No text until YES. A guard receives no operational text until the guard has replied YES to a request to confirm. Owners, managers, dispatchers and escalation contacts are texted only after they opt in the same way.
• STOP is always honored. A reply of STOP, or any of its standard synonyms, records the opt-out at once and is confirmed by one message. No further message is sent to that number, in any mode, until the person opts back in.
• Msg freq varies. Messages are operational only: never marketing, and never to a company’s clients. The full program terms are in our Text Message Terms.
• Incoming texts are accepted only when they carry a valid signature from Twilio; anything else is refused.

5. Payments

Payment events are accepted only with a valid Stripe signature, and each is processed once. Card numbers are held by Stripe, never by us.

6. Application safeguards

• Pages are served with a content security policy, are refused when embedded in other sites, and tell browsers not to guess content types.
• Sign-in codes and message commands are rate-limited.
• Secrets such as API keys are kept out of the code, supplied by the hosting environment and checked when the application starts.
• Important actions are written to an audit log. Personal details are removed from audit entries, and IP addresses are shortened before they are stored.

7. Backups, export and deletion

• The database is backed up daily, backups are kept for 7 days, and it can be restored to any point within that window.
• An owner can export all of the company’s data at any time: guards, sites, schedules, cases, messages, consent records, clock-in records, certifications and incidents.
• When a company’s account ends, its data is deleted on the schedule in our Privacy Policy. Text-message and consent records are kept for the period stated there, as evidence of consent and opt-outs.

8. Reporting a security issue

If you believe you have found a security problem in CoverageOps, email security@coverageops.co with the details. Please do not access or change data that is not yours, and give us reasonable time to fix the problem before telling anyone else. We will not pursue anyone who reports in good faith under these terms.

Other security questions can go to the same address or by mail: