The office
Each person sees what their role and their exceptions allow, and nothing more. For example, estimators see only their own leads, and what the company pays for materials is behind a permission of its own. The full list is on Roles and permissions. People who manage people also see each colleague's contact details from their profile; where a colleague signs in from is theirs and the person's alone to see. See The Team & security page.
The crews
Foremen and crew members see their own crew's jobs, with the address, scope, access notes and contact, and never prices or costs. They see their own expenses, inspections, driver file and the incidents they reported or are fixing, and no customers at all: the Customers page is not theirs. See Why crews never see prices or costs.
Your customers
Customers never sign in. They get links, each for one thing, that stop working after a while:
| Link | Shows | Works for |
|---|---|---|
| Quote page | The estimate as it was sent, your terms and the PDF, with Accept and sign or Decline. | 180 days; it stops once answered, when the estimate changes, or when the lead is lost or canceled. |
| Pay online | The invoice's brand, number, amount due and due date, and Stripe's checkout when your company has one. | 180 days; a void invoice's link stops at once. |
| Billing form | A form for their accounts payable contact, PO number, billing address and tax status. | 60 days |
| COI or W-9 | Your company document. | 30 days |
Every link is made by the background worker at the moment the email or text leaves, and belongs to that one message for good. The stored letter holds only a placeholder, so nobody who can read the Outbox, and no backup, holds a working link. When the letter comes back through your company mailbox (its Sent folder keeps a copy, a customer answers with it quoted, somebody forwards it), the shared inbox never gets the link either: the copy is left out, the link in any email shows as (customer link removed) however the mail program wrapped or broke it, an attached file holding it is left out and named, and a link can't be pasted into a reply or a text written in the app. Each link proves its own company to the database: a page opened through it can do that one thing, for that company, and nothing else.
The Asphalt OS team
A role named Asphalt OS staff lets the Asphalt OS team help set up your connections. Only it and your CEO can change them, and even they can't read a saved key back. See Connections.
The Automation helper that sends acknowledgments and reminders is not a person. It can't sign in, only the background worker can ever act as it, and it works under the same rules as everyone else.
Your own server
When Asphalt OS runs on your company's own server, whoever holds that server's administrator login can reach everything stored on it, as with any server. Keep that login to people you trust.
Use a strong password that you use nowhere else, and turn on two-factor sign-in, so a stolen password alone can't open your account. See Sign-in protections.