Security

How we keep your business safe

Your customer list, your pesticide records and your money. Here's exactly how each is protected, in plain words.

Your data stays yours

Walled off by company. Every record carries your company's ID and the database itself refuses to show it to anyone else. It isn't just a filter in our code: Postgres row-level security enforces it, and our tests try to break it on every change.
Homeowners see only their own records in the customer portal, enforced the same way.
Encrypted in transit (HTTPS everywhere) and at rest (database, backups and files).
Files and photos are private. Links to them are signed and expire.

No passwords to steal: you sign in with a one-time code sent to your phone or email.
Owners and office staff also use an authenticator app (two-step sign-in), because they can see money and customer data.
Idle sessions sign out on their own: after 12 hours for the office, 4 hours for bookkeepers.
Each person gets only what their job needs. A technician can't see your bank details; a bookkeeper can't change customers.

Card and bank payments run through Stripe, a PCI Level 1 provider. Card and bank numbers go straight to Stripe; Pestbook never sees or stores them.
Every change to customers, plans, invoices and payments is written to a permanent change log: who, when, and what it was before.

Pesticide application records and customer notices can't be deleted, by anyone. Corrections create a new version with who, when and why, and the original is kept.
Records are kept at least three years, longer where your state requires.

The technician app works with no signal and never loses a tap. It sends everything when it reconnects, and checks for conflicts with office changes.
The database is backed up continuously, with point-in-time restore. Restoring is a written drill we run before launch and every quarter.
We watch the app around the clock and get alerted to errors and slowdowns. You can check our status page any time.

The AI drafts; people approve. It can't move money, change prices or cancel service unless you turn that specific thing on, and everything it does is logged.
We use Anthropic's Claude through its business API, which doesn't train on your data.

Texts go only to customers who agreed to them, never during quiet hours, and STOP works on every message.

Email help@getpestbook.com with “security” in the subject. We answer within one business day and won't take action against good-faith research.

Our formal security review (SOC 2) is planned; until then, we're glad to answer a commercial client's security questionnaire.