Security

Every staff area requires an individual signed-in account. Staff roles (team member or manager) are held in a dedicated, protected roles table — never in editable profile data — and are checked by the database on every request. Managers control who gets access and can remove it at any time.

Row-level security is enabled on every table. This means the database itself enforces who can read or change each record — even if the application were bypassed, the data layer still refuses unauthorised access. Customer booking data can be submitted by the public but never read back by the public.

All traffic between browsers and the platform is encrypted with HTTPS/TLS. Data at rest — including uploaded photos and videos — is stored encrypted on managed infrastructure.

Photos and videos attached to requests are kept in a private storage area. They can only be opened through short-lived, signed links issued to approved staff — there are no public URLs.

Changes to sales, tasks and delivery checklists are recorded automatically with the author and time, giving managers a complete history of who did what and when.

Phone and browser alerts are delivered using the native Web Push standard. Notification content never includes customer contact details — alerts contain a summary only, and opening them requires signing in.

If you believe you have found a security issue, please report it to the CLAAS WA team immediately through your usual contact. We investigate all reports promptly.