Security
How we protect your data.
True Site Solutions is a young company and does not yet hold formal certifications like SOC 2. What follows is a plain, honest account of the practices we do follow today — we'd rather tell you exactly what's true than imply more than we can back up.
Encryption in transit
All traffic to and from the Service is served over HTTPS. Session cookies are marked secure and are not accessible to page scripts.
Password storage
Passwords are never stored in plain text. They are hashed with bcrypt before they touch the database, so we cannot read or recover them ourselves.
Role-based access
Every action inside an organization is checked against the requesting member's role — Owner, Admin, Operator, or Viewer — enforced on the server, not just hidden in the interface.
Isolated file access
Photos, signatures, and reports are stored in Amazon S3 behind short-lived, individually-signed URLs rather than public links, and access is checked against organization membership on every request.
Audit log
Organizations on our Professional and Enterprise plans get a record of administrative actions — who changed what, and when — for internal accountability.
Found a security issue?
We take reports seriously and will respond promptly. Please report it directly rather than filing a public issue.
security@truesitesolutions.com