Security

Two-factor sign-in with an authenticator app for the admin console and the employee portal. The secrets are stored encrypted, and a code cannot be used twice. An administrator can require it for a user.
Passkeys: sign in with a passkey instead of a password.
PIN sign-in: on a device marked as remembered, staff can sign in with a PIN. Five wrong PINs in a row clear the PIN; the person then signs in with their password and sets a new one.
Rate limits on every sign-in form, per IP address and per account.
Customers can turn on a one-time code by email for the client portal.

Turn on two-factor sign-in for everyone who can reach money, payroll or settings. Settings & Secrets › Security & 2FA holds the sign-in policy.

Sessions

Admin, employee-portal and client-portal sessions are separate. An employee-portal session cannot reach admin actions.
Cookies are HttpOnly, Secure and SameSite=Strict, so the app must run over HTTPS.
Sessions are checked against the database at least once a minute. Changing a password or resetting two-factor sign-in ends the person's other sessions.
An idle session times out.

Audit log

Every time staff view, search, create, change, delete, export or send something that holds customer or staff information, an entry is written to the audit log with who, what, when and from where. The database itself refuses updates and deletes on that table, so entries can be added but never changed or removed through the app. Administrators read it under Audit Logs.

Data on your server

Secrets live in secure_data/ beside the web root, never in it. Integration keys are encrypted in the database. See Settings and the secrets vault.
Device passcodes on repair tickets are encrypted at rest.
Off-site backups are encrypted before they leave the server. See Backups and moving servers.

Web protections

Public pages run under a strict Content Security Policy with no inline scripts. Only the checkout page also allows Square's payment hosts.
Public forms use a hidden field, a timing check and content scoring against spam.
The app refuses to call private or internal network addresses when it fetches a URL you entered, such as a webhook.
The sample Nginx configuration allows only the app's own API endpoints, and no other PHP file can run.

Updates

Updates are signed. The updater checks every release's checksum and Ed25519 signature before installing it. See Updates and renewals.

Good habits

Give each person their own account and the smallest role they need. See Users, roles and permissions.
Archive staff who leave rather than deleting them.
Rotate any integration key you think has leaked.
Keep the backup key and a copy of secure_data/ somewhere safe and off the server.