Security

Your customer list and your money data live here, so you deserve a straight answer on how it's protected. Here's our actual posture — including the parts we haven't finished yet.

One database, walled per company

HomeFront HQ is multi-tenant with row-level security enforced by the database itself — each company can only see its own data. The walls aren't just in the application code; they're in the storage layer.

Encryption

Data is encrypted in transit (TLS) and at rest. No plaintext on the wire, no plaintext on disk.

Permissions inside your workspace

Role-based permissions control who sees what within your company — your field crew doesn't see company financials unless you say so.

How we build

• Secrets live in environment config, never in code or version control.
• Inbound webhooks are verified before we act on them — no spoofed payment or message events.
• Rate limiting protects auth and public endpoints from brute force and abuse.

The honest part

Our infrastructure providers — Supabase and Vercel — are SOC 2 certified. HomeFront HQ itself is early-access and has not completed its own audit yet. We'd rather tell you that plainly than hide behind our vendors' badges.

Found a vulnerability?

Please report it to support@aelitecleaning.com. We read every report, we respond, and we won't shoot the messenger — good-faith research is welcome here.