What we do today. Nothing we can't show.
PeerToSite does not hold a security certification and doesn't claim to. This page states, in plain terms, the controls in place today and the ones we're still working toward.
Data in Azure Canada CentralIn place
Tenant isolation at the database (row-level security)In place
Two-step sign-in for everyone, lockouts, security headersIn place
Tax IDs encrypted at rest, masked on screenIn place
Audit log of changes and staff accessIn place
Signed-link downloads, malware scanningTarget
Independent penetration testPlanned before launch
SOC 2 / ISO 27001Not claimed
Controls
In plain words
Where your data is
- PeerToSite runs in Microsoft Azure's Canada Central region; its database and uploaded files are stored there.
- Fonts and scripts are served by PeerToSite itself, so opening a page doesn't send your address to an advertising or analytics company.
- Support tickets are answered by PeerToSite's own staff and stay in Canada.
- Card payments through Stripe (a US company) are in testing. Before any real person's details go to Stripe, our lawyer's review and the privacy policy come first.
Keeping companies apart
- Each company's records are separated in the database itself (row-level security), not only in the application, so one company can't read another's.
- A firm sees only its own offers, jobs and pay. A company never sees what a firm is paid, and a firm never sees a company's dispatch price.
- Technicians see their own jobs and no financial information.
Signing in
- Passwords are stored only as one-way hashes (argon2) and are never written to logs.
- Every account signs in with two steps: a password (or Microsoft) and a code from an authenticator app. A password reset asks for the authenticator code too.
- Repeated wrong passwords lock an account for a time, and changing a password signs it out everywhere else.
- PeerToSite staff sign in separately, always with two steps, and every record a staff member opens is logged.
Sensitive information and records
- Connections to PeerToSite are encrypted (HTTPS), and every page sends security headers.
- Contractors' tax identifiers are encrypted before they're stored, and masked on screen.
- Keys that connect your systems to PeerToSite, such as webhook signing keys, are encrypted in storage.
- Changes to postings, visits, approvals, invoices and account settings go into an audit log that can't be edited; Company Managers can read their company's log.
- Information is deleted on a schedule rather than kept forever — the periods are in the Privacy Policy and are working answers, to be confirmed with counsel. You can ask for a copy or deletion of your data from Settings → My Data.
Not yet
What is not in place
- PeerToSite does not hold a security certification such as SOC 2 or ISO 27001, and does not claim to.
- An independent penetration test has not yet been carried out. It is planned before general launch.
- Downloads aren't yet short-lived signed links, and uploads aren't yet scanned for malware — both are targets.
- There is no public service status page yet.
Found a security problem? Please contact us and say so in your message — we'll reply to you directly.