← Back to TrackOver

Security & Information Security Policy

TrackOver LLC · Security contact: security@trackover.io · Version 1.0 · Last updated September 4, 2026

This page describes how TrackOver protects the confidentiality, integrity, and availability of the data it processes — including consumer financial data obtained through the Plaid API. It applies to all TrackOver production systems, source code, third-party services, and everyone who accesses those systems. This policy is reviewed at least annually and after any material change to our systems or data handling.

Purpose & scope

TrackOver is field-service management software for contractors (jobs, scheduling, estimates, invoicing, and bookkeeping). Bank-transaction data is used solely to help a business owner reconcile their own expenses against receipts. It is never aggregated or shared across businesses.

Roles & responsibilities

The Security Contact (the company owner) is responsible for the security program: setting policy, granting and reviewing access, responding to incidents, and managing third-party providers. Anyone granted production access is bound by this policy and receives the least privilege required for their role.

Access control & authentication

• Role-based access control. Users hold one of three roles — owner, manager, or crew — each granted only the access it needs.
• Database-enforced tenant isolation. Every organization's data is separated by PostgreSQL Row-Level Security; access is scoped to the acting user's organization on every read and write, so one organization can never reach another's data.
• Least privilege. The elevated service-role database key is used only in trusted server-side code and is never exposed to the browser or end users.
• Multi-factor authentication. TOTP-based MFA (authenticator app) is available to all users, and owners can require it for managers or all users. MFA is required for administrative and owner/manager access to systems that handle consumer financial data.
• Non-human authentication. Machine and server-to-server access uses short-lived JWT bearer tokens, a server-only service-role key, and HMAC-signed URLs — all over TLS.
• Production access to hosting, database, and source control is limited to the owner, and each of those provider accounts is protected with MFA.

Data protection & encryption

• In transit: all traffic between clients, servers, and providers is encrypted with TLS 1.2 or higher; HTTPS is enforced everywhere.
• At rest: all consumer data — including data received from the Plaid API — is stored in a managed PostgreSQL database and object store encrypted at rest with AES-256.
• Secrets: API keys and credentials are stored as encrypted, server-side-only environment variables. The Plaid access token is held server-side and never exposed to the client.
• Data minimization: TrackOver requests only Plaid's Transactions product (read-only transaction history). It does not request Auth, Balance, Identity, Transfer, or any account-movement or credit product.

Infrastructure & hosting

TrackOver runs on managed, audited cloud infrastructure:

• Vercel — application hosting and serverless compute (SOC 2 Type II).
• Supabase — managed PostgreSQL database, authentication, and object storage on AWS (SOC 2 Type II; encryption at rest and in transit).

Production servers and databases are patched and hardened by these providers under their own security programs.

Secure development & vulnerability management

• Source code is version-controlled and changes are reviewed before release.
• Production infrastructure is continuously patched by the provider.
• Dependencies are kept current, and dependency vulnerability alerts are monitored and remediated.
• End-of-life software is actively avoided; the stack stays on supported, maintained versions.

Logging, monitoring & incident response

Application errors and security-relevant events are logged centrally and monitored, and an in-app audit log records sensitive actions with actor and timestamp. On discovering a security incident, the Security Contact investigates, contains, and remediates promptly, notifies affected parties and providers (including Plaid) as required, and records the incident and corrective actions. Suspected exposure of consumer financial data is treated as high priority.

Data retention & deletion

Consumer data is retained only as long as needed to provide the service. Users can delete their account, which removes their data (including stored files), and can disconnect a Plaid connection to stop further data retrieval. Retention practices are reviewed at least annually for compliance with applicable data-privacy laws.

Third-party providers

TrackOver uses a limited set of vetted subprocessors, each with a published security program: Vercel (hosting), Supabase (database, authentication, storage), Plaid (bank data), Stripe (payments), Twilio (SMS), Resend (email), and Anthropic (AI features). Consumer financial data from Plaid is not shared with any third party beyond what is required to store and display it to the owning business.

Privacy & consumer consent

Our privacy policygoverns data collection, use, and storage. Consumers authorize bank connections through Plaid Link, which captures consent within Plaid's own interface before any data is shared. TrackOver never sees a consumer's banking credentials.

Questions about our security practices? Contact security@trackover.io.