Keys sealed at rest
API keys and OAuth tokens are encrypted with AES-256-GCM, under a key that lives only on the server, before they are written to the database. They are opened in memory by the process that reads your source and nowhere else.
Security
Your key, sealed. Your customers, never seen.
A dashboard product holds the keys to your business system. Here is exactly what we do with them.
Never shown again
Once stored, a key is not displayed to you, to our support staff or in the admin console. It never appears in logs or emails. If you need to rotate it, you paste a new one.
Read-only by design
We read jobs, estimates, invoices, employees and the schedule. The product contains no code path that writes to Housecall Pro, Google Ads or any other source you connect.
One company per row
Every application record carries your account. Every read is scoped to it before it reaches the database. Caches are keyed by account. There is no cross-account query in the product.
Aggregates only in the analysis
The setup analysis receives counts and totals: job types, tags, people and their roles, lead sources, statuses. A customer's name, address, phone number or email never leaves your Housecall Pro account.
Encrypted in transit
Every connection, from the TV in your office to the source APIs we read, uses TLS. Your dashboards live on your own subdomain with its own certificate.
Backups and retention
The database is backed up nightly to encrypted storage off the server. When you cancel, your data is deleted thirty days after your last paid day unless you ask us to keep it.
Every change on record
Rule changes create a new numbered version with who made it, why and when it took effect. Sign-ins, key changes and TV links are logged per account.
Access
Who can see what.
Your team signs in with their own logins. TV links need no login: each is a long random token you can name and revoke, and only its hash is stored. The people at Yelu Marketing who work your tickets see your rules, your dashboards and the aggregates behind them, and nothing from your customer records.
If you need a data-processing addendum or have a security questionnaire, send it over. We would rather answer it than have you guess.
Ask a security questionPut the board up this week.
Fourteen days free, card at signup, nothing charged until you have seen your own numbers on it.