Security

The short version

• Your data is encrypted when it moves and when it is stored.
• Each company's data is walled off from every other company's at the database level.
• You control who on your team sees what, and you can sign everyone out in one tap.
• We never see or store full card numbers. Stripe handles them.
• If something goes wrong with your data, we tell you fast.
• Found a security problem? Email security@righthandcrm.com. We won't come after good-faith researchers.

This page describes how Right Hand, operated by Revive Flow LLC doing business as Right Hand, protects the data companies trust us with. Our binding security promises are in the Terms of Service (Section 9) and the Data Processing Addendum (Section 6). This page explains them in plain words. No system is perfectly secure, and we don't claim ours is. We describe what we do today, and we label anything that is still coming.

1. Where your data lives

• Right Hand runs on established cloud providers: Vercel (website, app and server functions) and Supabase (database, file storage and backend functions), in the United States. Their data centers have physical security, power and network protections we couldn't build ourselves. See our Subprocessors.
• Calls and texts run through Twilio. Card and bank payments run through Stripe.

2. Encryption

• In transit: every connection to Right Hand uses HTTPS (TLS 1.2 or newer). That covers the website, the dashboard, the iPhone app, client quote and payment links, and our connections to our providers.
• At rest: the database, file storage (photos, documents, recordings) and backups are encrypted at rest by our hosting and database providers.
• Passwords: stored only as salted hashes. Nobody at Right Hand can see your password, and we will never ask you for it.
• Connected accounts: sign-in tokens for services you connect (like QuickBooks or Google) are stored server-side and are never shown in the browser.

3. Keeping companies apart

Right Hand is used by many companies. Every record carries the company it belongs to, and the database enforces that each signed-in person reaches only their own company's data. Server functions check the company on every request; a person can't reach another company's data by changing a link or a number in a request.

4. Who can get in

4.1 Your team.

• Roles: owners, managers, office staff and crew members each see only the pages their role allows. Owners decide who gets what.
• Sign-in: email and password, or Continue with Google, Apple or Intuit. Repeated wrong passwords are slowed down and then locked out.
• Remember this device: keeps you signed in on that device for up to 30 days. Leave it unchecked on shared computers. When unchecked, the sign-in ends when the browser closes, and after 12 hours at most.
• Sign out everywhere: on the Team page, an owner can end every session for a person, or for everyone, at once. Use it when someone leaves or a phone is lost.
• Remove people the day they leave. Their access ends immediately.
• 2-step sign-in: if you sign in with Google, Apple or Intuit, the 2-step protection on that account applies. 2-step sign-in for email-and-password accounts is on our roadmap and isn't available yet. Until it is, we recommend owners use Google, Apple or Intuit sign-in with 2-step turned on there.

4.2 Our team.

• Only people who need access to run and support Right Hand have it, and only as much as they need.
• Right Hand staff accounts and admin tools are protected with multi-factor authentication.
• We look at a company's data only to support that company when it asks, to keep the service secure, or when the law requires it.
• Everyone with access is bound to confidentiality.

5. Records of what happened

• Change history: Right Hand keeps a history of important changes to records like clients, quotes, jobs and invoices, and who made them.
• Recently deleted: many items go to "Recently deleted" for 30 days so they can be restored. Signed documents can be locked so they can't be changed after signing.
• Security logs: we log sign-ins and security events and keep those logs for up to 1 year.

6. Payments

• We never see or store full card or bank numbers. Your clients type them into Stripe's secure payment fields, and Stripe stores them. Stripe is certified to the highest level of the card industry's security standard (PCI DSS Level 1).
• Right Hand keeps only what it needs to show a payment: amount, status, date, card brand and last four digits.
• Because Right Hand isn't a bank and doesn't hold your funds, the federal financial-privacy law for banks (the Gramm-Leach-Bliley Act) doesn't make Right Hand a financial institution. We still protect payment records as carefully as everything else.

7. AI and security

AI features send only what a task needs to our AI providers, under terms that don't allow them to train on it. Mike won't take card numbers or other sensitive numbers on a call or by text; it sends a secure payment link instead. See AI and Mike.

8. Backups and recovery

• The database is backed up automatically by our database provider. Backups are encrypted and kept for a limited time (they age out within 35 days).
• Backups are for recovering Right Hand from a disaster. They aren't a way to restore one company's single deleted record on request, though we will try to help if you ask quickly.
• Keep your own exports of records the law requires you to keep (Settings → Data → Export).

9. Building it safely

• Code changes are reviewed and tested before release.
• Secrets (keys and passwords for our providers) are kept in the hosting provider's encrypted settings, never in code.
• We review each provider's security and sign its data protection terms before it handles your data.
• We watch for errors and unusual activity and fix security issues as a priority.

10. If something goes wrong

• We have a written plan for security incidents: contain it, find out what happened, fix it, and tell the people affected.
• If we confirm that someone got into your company's data without permission, we tell you without undue delay, and within 72 hours of confirming it where we can. We tell you what happened, what data was involved, and what we are doing. See Data Processing Addendum, Section 7.
• We help you meet your own duties to notify your clients or employees. State laws set those duties. Florida's law, for example, requires notice to affected people within 30 days.
• Live status and incidents: status.righthandcrm.com.

11. Requests from governments and law enforcement

• We require valid legal process. We give data to a government or law-enforcement agency only when a valid subpoena, court order or warrant requires it, or in a real emergency involving danger of death or serious injury.
• We read requests narrowly and push back on requests that are too broad or not properly made.
• We tell the company first whose data is requested, so it can respond or object, unless the law or a court forbids us, or telling would make an emergency worse. If we can't tell first, we tell afterward when we are allowed.
• Company data belongs to the company. Where we can, we ask agencies to get it from the company directly.
• Requests go to legal@righthandcrm.com and ADDRESS.

12. What you can do

• Use Google, Apple or Intuit sign-in with 2-step turned on there, or a long, unique password.
• Give each person their own login. Never share logins.
• Give crew members crew access, not office access.
• Remove people the day they leave, and use Sign out everywhere for lost phones.
• Don't put Social Security numbers, full card or bank numbers, medical records or passwords in notes or files.
• Watch for fake emails pretending to be Right Hand. We will never ask for your password or a sign-in code.

13. Report a security problem (responsible disclosure)

Found a vulnerability? Email security@righthandcrm.com with what you found and the steps to reproduce it.

We promise to:

• reply within 2 business days and keep you updated
• fix confirmed problems as fast as we reasonably can
• credit you if you want, once it's fixed
• not take legal action against good-faith research that follows these rules

The rules:

• test only your own account or a test account, never another company's data
• if you reach anyone else's data by accident, stop, don't keep or share it, and tell us
• no denial-of-service attacks, spam, social engineering, or physical attacks
• don't test our providers (Stripe, Twilio, Vercel, Supabase and others); report their issues to them
• give us reasonable time to fix the problem before telling anyone else

We don't run a paid bug bounty right now.

14. Changes

We update this page as our security changes. We won't reduce the overall protection the DPA promises.

Revive Flow LLC, doing business as Right Hand · ADDRESS · security@righthandcrm.com