Security

Responsible disclosure

Report a suspected vulnerability to hello@floorops.com.au. Please include steps to reproduce, and do not access data belonging to another organisation.

Tenant isolation

Every business record in FloorOps carries an organisation identifier — customers, sites, jobs, rooms, takeoffs, estimates, quotes and revisions, work orders, products, materials, suppliers, staff, schedules, site records, variations, defects, completion records, invoices, payments, attachments and activity logs.

Access is enforced in the database with row-level security, not in the browser. Changing a URL, a record ID or a client-side value cannot reveal another organisation's data, because the database rejects the read before it returns a row.

Roles and least privilege

• Owners and managers administer the organisation, team, customers, financials and settings.
• Estimators work on measurements, takeoffs, estimates and quotes.
• Schedulers and administrators manage bookings, materials and documents.
• Installers see only jobs assigned to them, with the site and product information needed to complete the work — not margins, business-wide financial reports, or unrelated customers.

Role changes are restricted to owners and managers, and no user can elevate their own role.

Authentication

• Email and password sign-in with hashed credentials and email verification
• Self-service password reset using single-use, time-limited links
• Persistent, refreshable sessions with sign-out on request
• Protected routes redirect unauthenticated visitors to sign-in before any data is requested

Customer-facing quote links

A quote sent to your customer uses a long, random, non-guessable token. It resolves to that single quote only, exposes no internal application data, and is excluded from search engine indexing.

Secrets and server-side validation

Service credentials and private environment variables stay on the server and are never shipped to the browser. State changes that matter — quote acceptance, work order creation, document numbering, invoicing — are validated server-side and written to an audit log with the acting user and timestamp.

Reporting a vulnerability

If you believe you have found a security issue, contact us through the security address published on the contact page with enough detail to reproduce it. Please do not test against other businesses' data.