Security
A summary of how EquipQR keeps your data — and your customers' data — isolated and protected.
Tenant isolation by row-level security
Every table that holds customer, equipment, or service request data is protected by Postgres row-level security policies scoped to a company ID resolved server-side. One company's data isn't queryable by another — it's enforced at the database layer, not just in application code.
Encrypted in transit and at rest
All traffic to EquipQR is served over TLS. Data at rest — including equipment records, guides, and service request photos and video — is encrypted at rest by our infrastructure provider, Supabase.
No card data touches our servers
Subscription payments are handled entirely by Stripe. EquipQR never receives or stores your card number — only a subscription status and a tokenized reference from Stripe.
Least-privilege team roles
Owners and technicians have distinct permissions. Technicians can work equipment, customers, and service requests, but can't touch billing, team membership, or company deletion — so a compromised technician account has a limited blast radius.
Public pages expose only what's needed
The scan pages your customers see are served through access-controlled database functions that return only what's necessary to show a guide or accept a service request — never a broader view into your account.
Found a security issue?
Email support@equipqr.co with details and we'll respond promptly. Please don't test against other customers' accounts or data.