Security

Your business runs on the data in Maintaire — customer records, agreements, invoices, equipment histories. Here’s how we protect it.

Application security

• Tenant isolation: every record is scoped to your organization at the database layer; all queries are organization-filtered so one customer can never read another’s data.
• Encryption in transit: all traffic is served over TLS, with HSTS and hardened security headers (CSP, frame-ancestors, nosniff).
• Passwords: stored only as salted bcrypt hashes. Email verification is required for new accounts; password resets use single-use, expiring tokens, and changing or resetting a password signs out every other session.
• Role-based access: owner, admin, dispatcher, technician, and accounting roles in the app, plus separate restricted roles for customer-portal users. Removing or deactivating a user takes effect on their next request.
• Rate limiting: authentication and other sensitive endpoints are rate-limited to slow credential-stuffing and abuse.
• Shared links: public invoice, report, and signing links use long, unguessable random tokens. Voiding an invoice or an agreement turns its link off, and signing links can carry an expiry date.
• Auditability: electronic signatures are recorded with the signer’s name, timestamp, and IP address. Actions our own staff take in the support back office are logged with actor, timestamp, and IP address.

Payments

Online card payments, when enabled, are processed by Stripe on Stripe-hosted pages. Card numbers for those payments never touch our servers — we keep only Stripe’s reference for the customer and the payment.

Infrastructure

The application is hosted with Render, and the database and uploaded files with Supabase, in data centres located in Canada or the United States. The database is encrypted at rest by the provider. Third parties that process data on our behalf are listed at /legal/subprocessors.

Incident response

We maintain a breach-response process aligned with PIPEDA and Quebec Law 25: assess the risk of significant harm, notify affected customers and regulators where required, and keep records of all incidents for at least 24 months.

Reporting a vulnerability

If you believe you’ve found a security issue, email support@maintaire.com (also published at /.well-known/security.txt). Please include steps to reproduce and give us reasonable time to fix the issue before public disclosure. We won’t pursue legal action against good-faith research that respects user data and service availability.