What happens to your data
Written down, so it is not a promise made in a sales call. Where something is planned rather than done, this page says "not yet".
Where it runs
One server, in Docker, running the Vozanto application on MariaDB, published through a Cloudflare Tunnel. Every company on the server has its own books: each record carries the company it belongs to, and Vozanto's permission checks filter every list, report, search and export by it. A second, stronger arrangement, a database per company, is the plan for when there are paying companies; it changes the deployment and nothing in the app.
Who can see a company's data
Four jobs, four sets of keys. An owner sees everything, including the money. A dispatcher runs the day and never sees a wage. A salesperson works the leads and cannot move a truck. A foreman sees their own jobs on their phone and nothing in the office. A crew member's access ends the day their record is ended: one action closes the record, the login, every open session and every terminal token, and hands their open work to the person who pressed it.
Nobody at Vozanto opens a company's account without the company granting it. A grant is given by the owner from Settings, lasts 24 hours unless a shorter time is given and never more than 72, can be closed early, and every change made under it is written on the grant itself, where the company reads it. A change attempted with no grant open is refused. The owner is told, and agrees before the grant opens, that while support access is open, Vozanto's support can read your company's records, including your customers' emails: the ones on your jobs, and the mail read from your company Gmail.
Proved, not asserted
A test on the server signs in as one company's owner and tries to read another company's rows through every list, the search, every read endpoint that takes a record name, the REST interface and the configuration export. A single row from the other company fails it. The same run checks every role against every table for create, read, write and delete and compares the answer with the matrix the app wrote. A second test calls every endpoint that moves money as a foreman and as a signed-out visitor and expects each one refused.
Getting in
Passwords are stored as salted hashes. A second factor from an authenticator app is available and not yet switched on here; when it is, it is required of Owner and System Manager. Sessions can be listed and ended by the person or by the owner, which is what a stolen laptop needs. Sign-in with Google is on. Microsoft and Apple are built and not yet configured.
Encryption
In transit: TLS at the tunnel between your browser and the server. At rest: not yet. The database and files are on the server's own disk without a separate encryption layer; this changes with the hosted arrangement above. Backups are taken every day: the database, the files and the site's configuration, together. A copy goes off the machine the same morning to a private Backblaze B2 bucket, encrypted at rest by Backblaze, and each daily set is removed from the server after a day. The off-site copies are kept 30 days. The site's configuration goes off the machine without its encryption key, which is kept apart from the backups. A restore drill with a measured recovery time is not yet recorded.
Uptime and incidents
The status page is public and shows the state of each part of the service, any open incident, past incidents and the uptime since September 14, 2026, computed from a check every five minutes; twelve months of uptime is not yet published. If a breach of your data is found, you are told within 72 hours of us knowing, with what was affected and what was done.
Who else handles data
| What for | Who | What they receive |
|---|---|---|
| Text messages | Twilio | The phone number and the message (not yet connected here) |
| not yet a provider; mail stays on this server | The address and the message, and whether it bounced or was marked as spam | |
| Email from a company's own mailbox | Google or Microsoft, only when the company connects its Gmail or Outlook | The messages sent from it, and the customers' replies Vozanto reads onto their jobs |
| Addresses to map points | OpenStreetMap Nominatim | The street address being looked up, nothing about whose it is |
| Driving routes | OSRM (project-osrm.org) | The points of the route |
| Weather on the day | weather.gov | A location and a date |
| Backups | Backblaze B2 | A copy of each day's backup, kept 30 days: the database, the files and the site's configuration without its encryption key |
| Card and bank payments | Stripe | The amount, the job or the bill it is for, and the payer's email. The card or bank number is typed into Stripe's own form and never reaches Vozanto (not yet connected here) |
What is kept, and for how long
| What | Kept | Why | On a deletion request |
|---|---|---|---|
| Jobs, quotes and invoices | 7 years | Money records. Massachusetts and the IRS expect seven years. | kept, with the customer's name and contacts removed |
| Customer name, phone, email and address | while the account exists | Needed to do the next move and to answer the last one. | removed |
| Photos taken on a job | 2 years | Long enough for a claim; not forever, since they show the inside of a home. | removed |
| Signed documents (estimates, riders, day sheets) | 7 years | They are part of the money record. | kept |
| Text messages with the customer | 2 years | The record of what was agreed by text. | removed |
| Emails with the customer | 2 years | The record of what was agreed by email, whether sent from here or read from the company Gmail. Removed 30 days after a company leaves. | removed, with the pictures and PDFs they brought |
| Where the truck was (tracking points) | 30 days | Only useful on the day and for a dispute the week after. | not personal to a customer; pruned on schedule |
| Crew documents (licenses, certificates) | while the account exists | Kept while the person works here and for the year after. | not a customer record |
| Terminal tokens | while the account exists | Live until revoked; a revoked one is kept as a record of having existed. | not a customer record |
| What a change wrote, field by field, kept so the change can be put back | 90 days | Long enough to undo a change. The line that says who did what, and when, is kept after it. | the customer's name and values are removed from the lines |
| Sign-ins and changes (the audit log) | one year | So a company can see who did what. | kept |
A customer may ask the company for everything held about them, and the owner exports it as one file. A customer may ask for deletion, and the owner's one action does what the last column says and writes a line that it was done. Pruning on the schedule in the second column is not yet automatic.
Reporting a problem
A weakness in the software: write to security at the company's own domain and it is answered by a person. Please give us a fair chance to fix it before it is made public.
This page is generated from the running server, not typed. The retention table is the same one the deletion code reads.