SECURITY

Your customer list, prices and job history are the business. We treat them that way.

Small companies are where attackers go. In the 2026 Verizon breach report, 96% of ransomware victims were small organizations.1 Most small shops don't have an IT person, so the software they use has to do the protecting for them.

IN PLACE TODAY

How every Firmo app is built.

A separate database for each customerYour records don't share a database with anyone else's. There is no shared table where one mistake could show your data to another company.

Sign-in and rolesEvery person has their own login. Owners decide who sees prices, costs and invoices, and who only sees their own jobs.

An audit log of every changeWho changed a price, an invoice or an inventory count, what it was before, and when. You can look it up yourself.

Encrypted connectionsEvery page, on a computer or a phone, and every email link uses HTTPS. Passwords and keys for your other systems are kept in locked server settings, never in code.

Certified hosting in the U.S.Firmo runs on Railway, whose infrastructure carries a SOC 2 Type II report.2

Changes are tested on a copy firstNew features go to a test version with scrubbed data before they reach your live app. Names, phone numbers and emails are removed from that copy.

AI that doesn't learn from your dataAI features run on Anthropic's commercial service, which does not use inputs or outputs to train its models by default.3 Every AI draft is shown to a person before anything is saved.

Your data, exportable any timeDownload your records whenever you like. If you leave, you get everything, and then we delete it.

BEING ADDED AS WE GROW

What's next on our list.

We'd rather tell you what isn't done yet than let you assume it is.

Two-step sign-in for owners and office staff
Automated security scans on every code change, and weekly attack tests against a test copy
Scheduled backups with a regular restore drill
An independent penetration test once we have several customers live, with a summary we can share

QUESTIONS

Security questions.

Where is my data stored?

In the United States, on Railway, a cloud platform with a SOC 2 Type II report. Each customer has its own database.

Can other customers see my data?

No. Each company runs on its own database, and every sign-in is tied to one company.

Can Firmo Works staff see my data?

Only when you ask us for help, and only for what we need to fix the problem.

Do you use my data to train AI?

No. Our AI features run on Anthropic's commercial service, which by default does not use inputs or outputs to train its models. We don't sell your data or use it to train anything.

What happens to my data if I cancel?

You get a full export, and then we delete it from our systems.

Something we didn't answer? Email hello@firmoworks.com. If you think you've found a security problem, put "Security" in the subject line and we'll reply within one business day.

SOURCES

BOOK A 30-MINUTE DEMO

Show us your paper forms.

Bring the form you fill out most. We'll show you what it looks like in Firmo, usually the same week.

Not ready to talk? Email one paper form to hello@firmoworks.com and we'll show it back to you in Firmo, free.