Security

Security is a first-class engineering concern at RoutrIQ. This page describes our technical controls, compliance posture, and how to report vulnerabilities.

Encryption in transit

TLS 1.3 enforced

Encryption at rest

AES-256 (Supabase)

Auth standard

PKCE + JWT (Supabase Auth)

MFA

TOTP (all plans)

API security

HMAC-SHA256 signed keys

Rate limiting

Per-IP (Upstash)

Security headers

CSP, HSTS, X-Frame-Options

Audit logging

Immutable, tamper-evident

Infrastructure

RoutrIQ runs on Vercel (Edge + Node.js runtime) backed by Supabase PostgreSQL in us-east-1. Redis caching is provided by Upstash. All infrastructure is within US regions by default. Enterprise customers may request dedicated EU or APAC regions.

Database access uses row-level security (RLS) policies that enforce org-level isolation — no API path can read another organization's data, even with a valid JWT.

Authentication & authorization

All API endpoints require a valid API key (HMAC-SHA256, stored as a hash — the raw key is never persisted) or a Supabase session JWT. Keys are scoped to a single organization and cannot be elevated. Admin routes require an additional server-side secret.

Multi-factor authentication (TOTP) is available on all plans and enforced by default on Enterprise. SAML 2.0 SSO and SCIM provisioning are on the Enterprise roadmap — contact sales@routriq.com for current availability.

Data isolation

Every database query includes an org_id filter enforced at the RLS layer — bypassing it via the application layer is not possible. Supabase service-role keys are used only server-side and are never exposed to the client. Technician and job data are never shared across organizations.

FSM integration security

OAuth tokens and API keys for ServiceTitan, Jobber, and Housecall Pro are stored AES-256 encrypted in the database. Encryption keys are managed server-side. Tokens are decrypted in memory only at call time and are never logged or returned to the client. Redis token caches use per-org keys with TTL equal to the token's remaining lifetime.

Compliance

RoutrIQ is working toward SOC 2 Type II certification. All data processing is governed by our Privacy Policy and Terms of Service.

Responsible disclosure

If you discover a security vulnerability, please email security@routriq.com with a description of the issue and steps to reproduce. We target a 48-hour acknowledgment and a 90-day coordinated disclosure window. Please do not publicly disclose vulnerabilities before we have had an opportunity to address them. We do not currently offer a bug bounty but recognize researchers in our release notes.

For compliance documentation, penetration test reports, or to request a security review, contact security@routriq.com. Enterprise customers receive access to our full security documentation package including our most recent pen-test summary and SOC 2 bridge letter.