Security and your records

You own everything you put in: your customers, vehicles, repair records, photographs, prices and costs. We do not sell it, and we do not use it to advertise to anyone.

Downloading everything is included on every plan. From Settings › Shop profile, the owner downloads one ZIP file with a spreadsheet for each kind of record, the shop's ledger and every sealed record, and a second ZIP file with the photos.

Closing a shop removes nothing. After the account ends, the owner can still download the shop's records for as long as we hold them.

Each person signs in as themselves, with a link sent to their email, with Google or with Apple. On the shop floor, a person can sign in with a PIN.

PINs are stored only as a one-way hash. We cannot read yours, and we cannot tell you what it is.

Sign-in is rate-limited. After repeated wrong guesses, that name is locked for 15 minutes.

Sign-in cookies are HTTP-only and secure, and every page is served over HTTPS only.

What each person sees is decided on the server, not just hidden on the screen.

A technician's sign-in shows no prices, costs or margins. The front desk, service advisors and local managers see prices, not costs or margins.

Every act the shop's rules control, such as taking a payment, approving a refund, sealing a repair, changing someone's hours or adding a person, writes a line saying who did it and when. Nobody can edit that line, us included, and it is kept for seven years.

The links a shop sends a customer to their own records are kept out of search engines.

A finished repair can be sealed. Its record is fingerprinted with SHA-256: change one character and the fingerprint no longer matches.

It is signed with a key held in the deployment environment, not in the database, so someone able to edit the database still cannot forge the signature.

Each sealed record is linked to the one before it in the shop's chain, so a record cannot be taken out or moved without it showing.

It is tamper-evident, not tamper-proof. An alteration shows; nothing makes stored data impossible to change. A sealed record never changes: money owed back is recorded as a refund or a credit, as its own entry.

Every night, a copy of the whole database is written to storage kept apart from the database provider.

The application runs on Vercel, which also stores photographs. The database is on Neon. Every outside service that handles your records, and what each one sees, is named in the privacy policy.

We do not promise the service never goes down. The terms say so.

Your records or your privacy: privacy@scarab-os.tech.

A security problem, or anything else: help@scarab-os.tech.