How we protect your data
- Encryption
- All traffic to PatchCMD is encrypted with modern TLS, and browsers are instructed to use only secure connections. Stored data is encrypted at rest.
- Separation between companies
- Each company's records are kept separate at the database level. Every request is checked against the signed-in person's company before any data is returned.
- Access by role
- Owners decide who can see dispatch, billing and fleet information. Drivers see the work assigned to them, and access ends when a user is removed.
- Sign-in protection
- Repeated sign-in attempts are limited, and unusual sign-in activity is recorded and monitored.
- Activity records
- Changes to tickets, billing and user access are recorded, so a company can see who changed what and when.
- Photos and documents
- Load photos, signatures and paperwork are stored privately and opened only through short-lived links.
- Infrastructure
- PatchCMD runs on cloud infrastructure providers that hold independent SOC 2 Type II audits. The database is backed up automatically every day, and availability is watched around the clock by an independent monitoring service. Current status and uptime history are on our status page.
- How we build
- Changes pass automated tests and security checks before they reach production. Dependencies are kept current, and the application's security is reviewed regularly, including testing it the way an outside attacker would.
Your data
- You keep ownership of the records you create in PatchCMD, as set out in our Terms of Service.
- Your company's records are not shared with another company unless you choose to share them.
- Tickets, billing and reports can be exported to spreadsheets at any time.
- How personal information is collected and used, including driver location, is described in our Privacy Policy.
Keeping your account safe
Security is shared between us and the companies that use PatchCMD. We recommend that you:
- Use a unique password for PatchCMD that you do not use anywhere else.
- Give each person the least access their job needs, and remove users when they leave.
- Sign out of shared computers and keep company phones locked.
- Tell us right away if you see activity you do not recognize.
Reporting a vulnerability
If you believe you have found a security vulnerability in PatchCMD, please email support@pillarapps.com with "Security" in the subject line. Please include:
- A description of the issue and its potential impact.
- The steps, pages or requests needed to reproduce it.
- How we can reach you for follow-up questions.
What you can expect from us
- We aim to acknowledge your report within three business days.
- We will investigate, keep you informed of our progress, and let you know when the issue is resolved.
- With your permission, we are glad to credit you for the finding.
Guidelines
We ask that you:
- Access only the minimum data needed to demonstrate the issue, and never view, change or delete another company's data.
- Stop and report as soon as you encounter customer information.
- Avoid degrading the service for others, and do not use automated scanning that generates heavy traffic.
- Give us reasonable time to fix the issue before discussing it publicly.
Out of scope
- Denial-of-service testing, spam, or any attack that affects availability.
- Social engineering or phishing of our staff or customers, and physical attacks.
- Services and websites operated by third parties.
- Reports from automated tools without a demonstrated, practical impact.
Good-faith research
We will not pursue legal action against anyone who discovers and reports a vulnerability in good faith and in line with these guidelines. We do not currently offer a paid bug bounty.
This policy is also published in machine-readable form at /.well-known/security.txt.
Security questions
If your company, or a customer of yours, needs a security questionnaire completed or has a question about how PatchCMD handles data, contact us at support@pillarapps.com.