Security
- Encryption in transit: all app, dashboard and API traffic uses HTTPS.
- Authentication: Firebase Authentication with email and password or Google Sign-In. The API verifies a Firebase ID token on every request.
- Access control: each business's records are tied to the signed-in owner's account and cannot be read by other businesses.
- Offline first: records are saved on the device before they sync, so a connection failure never loses a reading.
- Rate limiting on the API, and photos are served only from per-business folders.
- Backups: uploaded photos are backed up daily to a second server.
Found a vulnerability? Email [email protected] with details. Please give us a reasonable time to fix it before disclosing.