Trust
Security
You are about to put your customers, their homes, their photographs and your margins into someone else’s software. Here is what protects them — and what we have not finished yet.
Separation between companies
Every record in ClaimMetrik belongs to exactly one company, and the separation is enforced in the database rather than in the screens. Row-level security policies resolve the caller’s company on every read and every write, so a request that asks for another company’s record returns nothing — regardless of what the interface does. Hiding a button is not access control, and we do not treat it as any.
Documents and photographs
Uploaded files live in private storage, never a public bucket. They are served only through short-lived signed links, issued per request to somebody whose role includes that file. The storage path itself carries the company boundary and is composed on the server, never by the browser.
Roles and permissions
Access is by capability, not by job title. A production manager can run their job’s costs without seeing company-wide financials; a canvasser sees no money at all. Financial visibility, job costs and the authority to declare a job’s final profit are separate permissions, checked on the server every time.
Money is hard to change on purpose
Recorded payments and posted costs cannot be quietly edited. Accepted proposals, issued invoices and closed financial results are immutable — corrections are new entries that leave the original visible. A retried request records the money once rather than twice.
Customer-facing pages carry no internal numbers
A proposal you share with a homeowner is built so that your cost, margin and profit are not merely hidden from it — they are not reachable by it. Those pages are tested with no account signed in, because a logged-in test of a public page proves nothing.
How we test
Security rules are verified by deliberately breaking them and confirming the test notices. A check that has only ever reported success is treated as unproven until it has been made to fail. That discipline is applied to tenant isolation, financial permissions, public pages and file access.
Backups and recovery
The database is backed up by our hosting provider. File recovery has been drilled end to end: files were backed up, deleted, restored and verified byte for byte, with the storage still private afterwards.
What we have not done
- No SOC 2, ISO 27001, HIPAA or PCI certification. We hold none of these and do not claim to.
- No third-party penetration test has been performed.
- No uptime guarantee. We have not operated long enough to stand behind a number, so we do not publish one.
- A full database restore has not yet been rehearsed. Backups exist; recovery is only proven by restoring, and we have not completed that drill. File recovery has been drilled.
- Uploaded files are not scanned for malware. They are stored privately and served through short-lived links, but they are not scanned.
Reporting something
If you find a security problem, tell us through the contact form and we will take it seriously. We would rather hear it from you than not hear it.