Security and data
Security and data
NamaCor is built by a finance and accounting team, for records an auditor may one day read. Here is how the data is hosted, protected and traced.
Where the data lives
The database (Postgres) and the files (receipts, photos, documents) are stored in Canada, in Montréal (Supabase, ca-central-1 region), in private buckets organised per company and per project, and served only after the access rules have been checked. Some providers process data outside Canada: Vercel (application servers, United States), Anthropic (AI bill reading, United States), our transactional email service (United States) and Xero.
Access by role
Every table is protected by row-level security in the database. Owners do everything; office users run the business; field users see only their assigned projects, their own hours, the daily log and the schedule. Workers' internal rates live in a table only the owner can read, and frozen labour costs in a table only the office can read. No field policy can expose an amount.
Authentication
Sign in by email link or by password. Invitations and sign-in links are single-use and valid twenty-four hours. The confirmation page only consumes the link when the person actually arrives on it, so corporate link scanners cannot burn it.
The Xero connection
OAuth 2 with the scopes NamaCor needs and nothing more. Tokens are stored encrypted in a vault, rotation is handled automatically, and Disconnect revokes the token at Xero. Before anything syncs, the owner confirms the organisation, and an allow-list can restrict which organisations NamaCor may write to.
Audit trail
Every call to Xero is logged with its request, response, status and duration. Client approvals of quotes and change orders record the typed name, the date and the IP address. Emails sent from the app are logged under their document.
Client portal and public links
Portal users have no membership in your company and read through dedicated policies that never expose costs, hours or margins. Public document links use random 32-byte tokens, expire after 180 days, are extended on each send and can be revoked.
AI reading of bills
Supplier bills and receipts dropped in the inbox are read by an AI model to extract the vendor, amounts, taxes and lines. The extraction is a suggestion; a person confirms before anything becomes a cost. Documents are stored in your company's private bucket.
Quebec's Law 25
Database and files in Canada, access limited by role, an audit trail, and a named privacy contact. If you need a data processing agreement or a description of the sub-processors, ask us.
Questions about security or a specific requirement from your accountant or auditor? Write to us; we answer in detail.