Hoseworks is built so your data stays yours. Security isn't a bolt-on. Tenant isolation is enforced at the database layer, not just in application code.

Multi-tenant isolation at the database

Every business on Hoseworks is a separate tenant. Access is enforced with database row-level security, so one company can never read or write another company's clients, properties, photos, quotes, or messages, even if application code had a bug. Crew-level roles layer on top: a field tech sees only their own crew's visits and customers, while owners and admins see everything in their business.

Encryption

All traffic is encrypted in transit over HTTPS/TLS. Data at rest is encrypted by our infrastructure provider. Customer-facing links (quotes, invoices, visit tracking) use signed, single-purpose tokens scoped to one record.

Least-privilege access

Privileged, isolation-bypassing database access is restricted to server-side code only and never ships to the browser or the mobile app. Secrets live in environment configuration, never in client bundles or source control.

Payments

Card payments are processed by Stripe, a PCI-DSS Level 1 provider. Hoseworks does not store full card numbers.

Reporting a vulnerability

If you believe you've found a security issue, please email us so we can investigate and respond quickly. We appreciate responsible disclosure.