Security and data isolation

How your company's data is separated and how access is controlled.

• Company isolation — every record belongs to a company, and every query is scoped to the signed-in user's company.
• Passwords — stored only as salted scrypt hashes. Reset links are signed, expire after an hour and stop working once used.
• Sessions — kept server-side. End every other session with Sign out all devices in Settings → My account.
• Google sign-in — sign in without a password using your Google account.
• Roles — admin, manager, operator and viewer; most settings are admin-only. Deactivated people can't sign in.
• API keys — read-only or read-write, scoped to your company, shown once and stored as SHA-256 hashes; revoke them at any time.
• Audit trails — invitation and administration events, purchase-order approvals and every work-instruction step are recorded with who and when.
• Backups — admins can download a full company backup and review a restore before applying it, from Settings → Data management.

Questions about security? Email support@grapha.ca.