BossHours security

BossHours holds your customers, jobs, photos and invoices, so we treat that data as yours and keep it locked down. This page says in plain words how.

Everything between your phone or computer and BossHours travels over an encrypted HTTPS connection (TLS). Data stored in our database and file storage is encrypted at rest by our hosting providers.

Every business on BossHours has its own private space. The database enforces this itself with row-level security, so one contractor's customers, jobs and money are never visible to another contractor, even if a screen had a bug. We test this separation automatically every time we change the database.

Inside your business, the owner decides who sees what: owners, office staff, technicians and customers each get their own view and only see what their role needs. Sign-in is by email and password, with optional two-step verification (an authenticator app code) for owner accounts. BossHours staff do not browse customer data; we open an account only to fix a problem you ask us about, and only the people who need to.

Card payments are handled by Stripe. Your card number never touches our servers and we never store it.

Data is hosted with established cloud providers (database and file storage on Supabase, the website on Vercel) in the United States. Backups are taken regularly and kept separate from the live system, so we can restore after a mistake or an outage. The providers we use are listed on our privacy page.

When you turn on the AI phone receptionist or AI helpers, only what is needed for that task is sent to our AI and phone providers. We do not sell your data.

If we find a security incident that affects your data, we tell the affected account owners without undue delay and within 72 hours of confirming it, say what happened, and tell you what to do.

Found a vulnerability, or want to ask how we handle something? Email support@getbosshours.com with the subject "Security". We read it the same business day when we can. To delete your data, see delete account.