Security and your data
You are handing us your customer list. Here is what holds it.
Not a page of padlock icons. Each of the things below is a control that is switched on right now, written where it cannot be forgotten, and tested by trying to defeat it.
Separated in the database, not in our code
Every table carries the organization it belongs to, and the database refuses rows outside yours before any of our code runs. A query that forgot to filter returns nothing rather than somebody else’s work — which is the difference between a boundary and a habit.
Money and legal records need a role
Payments, mandates, contract templates and amendments are writable only by an owner or an admin, enforced by the database rather than by a check in a screen. A crew member’s login cannot make those writes even with the browser open and the network tab in hand.
A signed document cannot change afterwards
The exact wording shown at signing is frozen when it is sent, frozen again when it is signed, and served from that snapshot. Editing the quote, or publishing a new version of your template, cannot move the terms under a customer who already has the link open.
And it is checked, not just stored
Each signed document is rendered to a PDF, fingerprinted, and kept. Every night that fingerprint is recalculated from the stored file — so a document that was altered or lost is something we find out about, rather than something you discover in a dispute.
Ledgers the database refuses to edit
What an AI assistant did, what was archived, who accepted which version of the terms, and every action our own staff take are written to tables with no update and no delete — including for us. A record that can be tidied afterwards is not evidence of anything.
Files are private and served by the link, not the URL
Photos, quote PDFs and receipts live in private storage. Customer-facing links are short ones we issue and can revoke; the underlying file address is never handed out, so a link forwarded on cannot be edited into somebody else’s.
What we can see, and what we cannot do
Somebody has to be able to answer “why did this invoice not send” at four in the afternoon. The question is what that costs you.
Read-only, always.
Support access can look at a workspace to diagnose something. There is no path that writes to your records as you — not a restricted one, not a time-boxed one. It was not built, because building it would have meant putting a fake member on your team.
A separate door, with a second factor.
The operator panel is on its own address, refuses to admit it exists to anyone else, and requires a second authentication factor. A staff account holds no membership in any customer workspace at all.
Every look is recorded.
Reads and changes are both written to an append-only log that names who, when and which business — a table the database will not let anybody update or delete, us included.
Suspension does not reach your customers.
Even an operator suspending an account cannot break a signing link. Those pages do not go through the gate, and a test asserts they never start to.
Two kinds of data, kept apart on purpose
Your account — who works there, what you pay — is ours to be responsible for. Everything about your customers is yours; we only ever process it on your instruction. The distinction runs through the whole privacy policy and the data processing terms, and it is the reason a homeowner’s details in your workspace are never treated as ours to use.
What we are not claiming
- We have not been through a SOC 2 audit, and there is no report to send you.
- We have not had a third-party penetration test.
- The nightly check on stored documents detects damage or loss. It is not a backup of that document storage, and we are not going to describe it as one.
- Two capabilities are built but have never been run end to end against the live provider they depend on, so we do not advertise them as working. They are the phone answering and the tenant-owned messaging number.
If any of those changes, this list is the first place it will change — we would rather lose a sale to a bigger vendor’s certificate than win one by implying we hold it.
The questions people actually ask
Can another contractor using Relayhand see my customers?
No, and the reason is worth being precise about: the separation is enforced by the database itself, not by our application remembering to filter. A member of another business asking the database directly for your rows gets an empty answer. We test that by bypassing our own code and asking as them.
Who at your end can see my data?
Support access is a read-only view, from a separate sign-in that requires a second factor, and every read and every change is written to a log that cannot be edited or deleted. There is no “log in as this customer” button — impersonating a tenant would have needed a fake membership in their team, visible on their own team screen, so it was not built.
Do you own or sell what I put in?
No. Your customer records are yours; we hold them to run the service for you and for no other purpose. We do not sell data, and we do not use one business’s customer records to do anything for another business.
Are you SOC 2 certified?
No. We have not been through a SOC 2 audit and have not had a third-party penetration test. We would rather tell you that than let a page full of padlock icons imply otherwise. What we can show you is on this page, and every control listed is one you could verify by trying to break it.
What happens to my data if I leave?
Cancelling deletes nothing. Your workspace stays readable so you can get your records out, and signed documents stay downloadable. Ask us to close the account and we delete it — with the exceptions the privacy policy sets out and explains, which are the records we have a legal or evidential reason to keep: billing and tax records, who accepted which terms, signed agreements themselves, and anyone who asked not to be contacted.
Do you track where my crew is?
No. There is no location tracking and no breadcrumb trail in the field app. Hours are recorded when somebody starts and stops a timer, and corrections keep the original reading alongside the edit, because a record that can be changed invisibly is no use for payroll.
What it costs, and what happens to all of this if you stop paying, is on the pricing page.
Put one real job through it
The fastest way to judge any of this is to send one contract and watch what happens to it.