EarnFlowBuilt around the controls auditors ask about.
A five-person crew gets the same protections as a national operator: strong sign-in, tamper-evident history and staff access only with your approval. We are a young company, so we publish what we do rather than what we hope to certify.
Sign-in
Two-factor authentication with an authenticator app, required for every user, ten recovery codes, lockout after repeated failures, short-lived access tokens with rotating refresh tokens, replay detection and the ability to sign out every other session.
Audit trail
Every create, update and delete of every record is logged with who, what, when, where and why. Events are append-only in the database and chained with HMAC-SHA256 signatures keyed outside the database, so deleted, modified or reordered history is detectable.
Isolation and roles
Each organization's data is scoped on every request. Roles and granular permissions decide who sees customers, finances, HR fields and the audit trail. Technicians see their own jobs, customers and conversations only.
Support access you approve
EarnFlow staff cannot browse your workspace. A support specialist requests a grant with a reason and a scope; you approve it; it expires on a timer; every read under it is recorded in your audit trail; you can revoke it at any time.
Documents
Files are kept in private storage on our server in Canada with non-overwriting names, scanned for malware on upload, limited by size and type, and downloaded only through authenticated single-use links.
Payments
Customers pay through Stripe Checkout directly into your Stripe account. EarnFlow never holds funds and never sees card numbers. Webhooks are signed and de-duplicated so a payment is never recorded twice.
Encryption, secrets and infrastructure.
- TLS everywhereHTTPS with HSTS for the web app and the API, and TLS between the application and its database.
- Secrets encrypted at restTwo-factor secrets and integration credentials are encrypted with keys held outside the database, in the server's access-restricted configuration.
- Hardened sessionsBrowser sessions keep the refresh token in an HttpOnly, Secure cookie bound to allow-listed origins. Access tokens are short-lived, refresh tokens rotate, and reuse is detected.
- Least-privilege runtimeThe API runs as an unprivileged user in a container with health probes, separate secrets per environment and network-restricted database, storage and scanner.
- Launch preflightAn automated check refuses to go live with unsafe cookie, TLS, origin, JWT, email, payment or storage configuration.
- Secrets never loggedPassword hashes, tokens and encrypted fields appear in the audit trail only as [REDACTED]; message bodies are never stored in audit events.
- Review and sign-offChanges by platform staff, by support specialists and by agents acting on their own are flagged for review under your organization's compliance policy.
- Verified chainThe audit chain is sealed every minute and re-verified every day, and any mismatch raises an alert.
- BackupsThe database and all documents are backed up every night and before every release that changes the database, copies are kept off the server, and a test restore runs every week.
- Account deletionAny person can delete their account from the app; personal data is erased and every session revoked.
Automation that proposes, never surprises.
Every agent and optimizer shares one safety model: it acts as the person, sees only what that person may see, and nothing reaches a customer or the schedule until a person approves it, unless the organization explicitly chose to let an agent act on its own. The agents and the dispatch optimizers don't use a language model and send nothing to an AI provider; only the Estimator and EarnFlow Support AI do, and only with consent.
Consent first
Before the Estimator sends anything to our AI provider, Anthropic, each person is asked for explicit consent, shown what is shared, asked again if that changes, and can withdraw. Support AI reads an account only under a support access the customer approved for it.
No invented prices
Drafts only ever contain prices from your catalog or amounts a person entered. Code prices every line.
Sensitive data excluded
HR notes, emergency contacts, payment processor references, clock-in locations and file contents are never sent to a model.
Injection-resistant by design
Text in customer records is treated as data. Because every change is a proposal a person approves, planted instructions cannot act on their own.
Designed for SOC 2 style reviews.
EarnFlow's audit trail, change review and support-access controls map to the SOC 2 criteria for change management (CC7.2, CC8.1) and logical access (CC6.1 to CC6.3). We are a young company and do not yet hold a third-party attestation; we publish what we do so you can assess it, and we are happy to complete your security questionnaire.
Personal information is handled under Canada's PIPEDA and applicable provincial law. See our privacy policy and subprocessor list.
Found a vulnerability?
Email security@earnflow.ca with the steps to reproduce. We acknowledge reports within two business days, keep you informed while we fix the issue, and will not pursue good-faith researchers who respect customer data and give us reasonable time to respond. Please do not test against accounts you don't own; a free trial organization is the right place to look.
Try EarnFlow free for 30 days.
A card on file, not charged until the trial ends. Add your team and your customers, plan tomorrow, and see what the agents catch.