Security at TradeFlo
Workspace isolation
Core contractor records use contractor workspace identifiers and row-level access rules so authenticated users access records associated with their workspace.
Authentication and protected functions
Administrative and employee workspaces require authentication. Sensitive backend operations validate the signed-in user and contractor ownership before acting. Public endpoints are kept narrow and are validated for their specific public purpose.
Free-tool data
The free change-order handoff uses temporary browser session storage and expires after 24 hours. It is removed after a successful import into an authenticated workspace. Email delivery is rate-limited and validates the requesting origin and recipient format.
Payments
Payment-card information is handled by connected payment processors rather than stored directly in TradeFlo application records.
Responsible disclosure
If you believe you found a security issue, contact imanihanks@gmail.com with steps to reproduce it. Do not access or modify data that does not belong to you.