Security
Your shop's records are yours. Here is how we keep them that way.
Each shop is walled off
Every shop's data sits behind row-level security in our PostgreSQL database. Each request runs as one shop, and the database itself refuses rows from any other shop, even if our code asks for them.
Encrypted and backed up
All traffic uses HTTPS, and browsers are told to use HTTPS only. The database and photo storage run on encrypted disks at Fly.io in California. The database is snapshotted daily, and each snapshot is kept for 14 days.
No passwords to steal
You sign in with a link we email you. There is no password to reuse or leak.
Agents get only what you give them
Each agent key works for one shop. We store keys only as hashes, so we can't read them back. The owner can see every key and revoke any of them at any time. Every action is recorded in the shop's activity log.
Some steps always need a person: signing, entering a card and connecting Stripe. Doing Work refuses agent keys on those steps. An agent can give a refund up to the owner's limit, which is $250 unless the owner changes it. A bigger refund waits until the owner or office approves it.
Cards stay with Stripe
Customers pay on Stripe Checkout, so card and bank numbers go straight to Stripe. We never see full card or bank account numbers.
Photos
Your shop's photos keep the time, location and camera details they were taken with, so you and your agents can sort them by job site and date. Copies that leave your shop are cleaned first: share links, photos on quote pages and PDFs have that data removed. Photos a homeowner sends with a quote request have location and camera data removed when they arrive, before any shop sees them.
No AI on our side
Doing Work runs no AI model on your data, and we don't send your data to an AI provider. AI comes only from the agents your shop connects.
Who else handles data
A short list of companies run parts of the service. See subprocessors. We don't sell your data or your customers' data.
Report a problem
Found a security issue? Email security@doingwork.work. We reply within 2 business days. Our security.txt has the details.