Trust & Security

This page describes the controls in SayfTread today, in plain English. We don't claim certifications we haven't earned.

Each shop's records are kept separate: Shop records are restricted by organization at the database layer, not just hidden in the screens. A person signed in to one shop can't read another shop's customers, quotes or invoices.
Access by role: Every team member is an Owner, Manager, Service Writer or Technician. Technicians work on assigned jobs and installation records without seeing costs, profit, supplier or payment details. Managers can't grant themselves or others Owner access.
Changes are logged: Record changes, work-order status changes, team invitations, invoices and recorded payments are written to an audit log. Financial and approval records are kept rather than overwritten.
Customer links: Where implemented, public access tokens are randomized, time-limited, and sensitive token values are not stored in ordinary readable form. Links can be revoked, and customers make decisions only by pressing a button on the page.
Secrets stay on the server: API keys and other credentials are kept in server-side settings and are never sent to the browser.
Production safeguards: The live environment refuses demo shops, test payment processors and demo resets.
Encrypted connections: SayfTread is served only over HTTPS.
Card numbers don't belong in SayfTread fields: Please don't type card numbers into notes, customer fields or other normal SayfTread fields. SayfTread doesn't store card numbers. Integrated payment credentials, when a shop activates Sayfpay, are handled separately from normal shop records.

Questions, or found something that looks wrong? Email support@sayftread.com.