Company records stay behind company access.

Separate company data

Jobs, employees, hours, schedules, materials, documents, events, and billing records carry a company boundary. Database row rules restrict access to authorized company members.

Roles and work views

Owners, administrators, managers, field leads, employees, and viewers have different permissions. Office and field screens are checked separately from paid-feature access.

Protected accounts

Registration, sign-in, recovery, and persistent sessions use managed authentication. App routes require a valid signed-in session before company data loads.

Restricted files

File paths include the company boundary. A signed-in user must be allowed to see the linked company or job record before opening a protected file.

Location consent and retention

Live employee location, trails and geofences are planned Crew tools and remain unreleased. Collection requires employee consent and device permission, an open shift and server checks for the employee, shift, break and capture time. Device and background behavior still require acceptance.

The installed cleanup task runs hourly. Location samples and identifying movement records follow the shorter company or employee-consent retention setting, with a 30-day default. Minimal clock-action receipts preserve retry and audit history without raw coordinates. Installing cleanup does not enable location collection.

Server-side checks

The browser does not decide who owns a record. Database functions and row policies re-check company membership, role, and feature access.

Audited admin changes

Platform administration is limited to approved administrators. Company-status and paid-feature changes create audit records.

No zero-risk promise

No online system can promise zero risk. CMD Ops uses layered access controls, keeps the application private from search indexing, and reviews security findings as the product changes.