Each company's data is its own
- Every record carries the company it belongs to. The database shows people only their own company's records, on every read and every change.
- A record of one company can't point at a record of another.
- People lists and company details are limited to your own company too.
- Nothing is shared between companies: not customers, not files, not the keys for outside services. See Connections.
Rules in the database, not just the screens
Who can see and change what is checked by the database itself. If a button is hidden, it is for convenience; the rule underneath still holds. The same goes for the business rules: an estimate over the limit can't be marked sent, a job can't be closed without its money lines, an expense can't be approved by the person who sent it.
The database checks who is acting
Until 23 September the app server told the database "I am Alex, working for Peach" and the database believed it. Now the database believes a person is acting only after it has checked something itself: a live sign-in, where the password and the two-factor code are checked by the database and not by the app server; a live customer link (a quote, a billing form, a shared document or a pay page); or the background worker's own login. That belief lasts for one step of work and then disappears.
- A taken-over app server, or a stolen app password, can act only as the people using Asphalt OS at that moment and through the customer links open then. It can never act inside a company where nobody is signed in and no link is open, and it can never be a company's Automation helper: only the background worker can.
- The app server can't start a sign-in on its own, read stored passwords or clear a lockout, and a stolen copy of the database can't be used to sign in as anyone.
- Each feature reads only its own service's key, for the person using it, and the mail service's, the mailbox's, Twilio's, Stripe's and QuickBooks' keys are the worker's alone. See Connections.
- Open on purpose, and written down: while someone is signed in, a taken-over app server can act as them, and open the files that person could already see; and a code phished from you in real time passes your second step.
Every stage of this work was attacked by an independent tester before it merged, and once more on 25 September; the verdict was a pass, with the two open items above pinned by checks so they can grow no wider.
Things Asphalt OS doesn't keep
- Payroll is tracked as totals only: there is no place for per-employee pay or bank details. The one Social Security number Asphalt OS can hold is a person's own, entered by them on My profile if they choose to: stored encrypted, never shown back (only its last four digits), and revealed to someone with "View full Social Security numbers" for 10 seconds after their password again, with a line in the history log and an alert to the owners. It never appears in tasks, alerts or the log.
- Bank account numbers are never stored. Card numbers are never typed into Asphalt OS: a real payment goes through Stripe's own checkout, on your company's own account.
- The keys for outside services can't be read back once saved.
Files stay where they belong
Every upload (photos, receipts, recordings, documents) is stored in its own feature's folder, and a record can only point at files from its own feature. A receipt can never be opened through an incident, for example.
- Every file is encrypted on the disk under a key of its own, which is itself locked by the server's master key. A copied disk gives nothing away. If the master key is lost, the files can never be opened again, so whoever runs your server keeps that key in a password manager.
- A file you delete or replace is really gone: from the disk, and from every backup taken afterwards. A file that something else still uses is always kept, and a nightly clean-up removes anything left over, looking only inside your own company's folder.
Every file has its own key
Every upload is encrypted before it reaches the disk, and each file is locked with a key of its own. When you open a file, Asphalt OS unlocks that one file, and only because you were already allowed to see the record it belongs to: a crew member's receipt opens for that crew member and the office, and for nobody else. There is no company-wide key that opens every file, so even a stolen sign-in reaches only the files that person could already see. Whoever gets hold of the disk or a backup gets nothing readable without your server's master key.
Nothing leaves unless you switch it on
- Weather forecasts and address lookups send job-site locations to free US government services, so each has a card on Connections with a built-in stand-in that sends nothing out.
- The AI chat, the shared inbox's AI, call transcription, QuickBooks, online payments, texting and email sending work only once your company connects them.
- The shared inbox's AI uses your company's own Anthropic key, and only the background worker reads it for that: the app server never does. For each email it reads, the AI is sent the sender, the addresses, the subject, the text (cut at 20,000 characters) and the attachments' names, types and sizes, never their contents unless the owner switches Read attachments too on (then its PDFs and photos go too, and the switch asks the owner's password again). Each request is put together inside your company's own database access, so another company's mail can never be in it. A suggested reply is drafted for the person who asked alone, from the conversation and only the facts that person may see (a quote's amount only for people who price quotes, an invoice only for people who see invoices); nobody else can read it. The morning digest is written from counts and the waiting conversations' subjects, never an email's text or a price, and goes to and is read by only people who work the shared inbox. A conversation's owner, and so its "Handle email" task and its nudge, is always somebody who can open its box. The AI sends nothing by itself unless the owner lists the categories it may answer (then only when the database agrees, letter by letter: sorted by the AI itself at least 90% sure, nothing to promise and no money in any words, never to somebody who asked for no email, business hours, under the cap; for such a reply it reads the conversation, the record's name and stage and your voice lines and templates, never an amount, and every reply it sends is marked "Sent by the AI" with a task for a person to check it), and it creates nothing until a person presses Create; the server's log records that it sorted a conversation and what it cost, never what an email said. The owner can also have Asphalt OS let go of email text older than a number of days (the conversations stay, and your mailbox keeps every email), and have each reply copied into the mailbox's own Sent folder, which needs a wider permission on the mailbox granted in a second consent step. Each of these is the owner's alone, off to start, and asks for the password again. See The AI assistant.
A history nobody can rewrite
Changes to people, roles, settings and business records go into a history log that can be added to but never edited or deleted. See The history log.
Backups
On your own server, Asphalt OS backs itself up every night, encrypted to a key only you hold, checks each backup by restoring it on the side, and keeps 30 days. See Backups.