Security
Security is a first-class engineering concern at RoutrIQ. This page describes our technical controls and how to report a vulnerability.
Infrastructure
RoutrIQ runs on Vercel with a Supabase PostgreSQL database in a US region. Redis caching is provided by Upstash.
Authentication & authorization
API endpoints require either an API key or a signed-in session. API keys are stored only as a hash, belong to a single company, and cannot be used for another company. Two-step sign-in with an authenticator app is available on every plan.
Data isolation
Each company's jobs, technicians and settings are tied to that company. Every dashboard page and API route looks up the signed-in user's own company and reads only that company's records. Server-side database keys are never sent to the browser.
FSM integration security
Credentials for ServiceTitan and Housecall Pro are encrypted before they are saved. They are decrypted only when RoutrIQ calls the provider and are never logged or returned to the browser.
Responsible disclosure
If you discover a security vulnerability, please email security@routriq.com with a description of the issue and steps to reproduce. We target a 48-hour acknowledgment and a 90-day coordinated disclosure window. Please do not publicly disclose vulnerabilities before we have had an opportunity to address them. We do not currently offer a bug bounty but recognize researchers in our release notes.