Security at Roll On Call
Your customer list, job history and payments are the business. Here is exactly how Roll On Call protects accounts and keeps each company's data separate.
The controls in place, grouped by what they protect
Authentication
Verified identities before anyone reaches company data.
- Email confirmationNew accounts confirm their email address before company onboarding. Temporary and disposable inboxes are not accepted; permanent aliases and privacy relays are.
- Phone verificationPhone numbers are verified with a one-time code sent through a dedicated verification provider.
- Multi-factor authenticationUsers can turn on MFA so a password alone is not enough to sign in. SMS recovery is available through verified numbers.
Isolation and permissions
Each company sees only its own records, and each role sees only what it needs.
- Tenant separationEvery company's data is isolated with row-level security in the database, so one business cannot read another's records.
- Role-based accessOwners, office managers, dispatchers and technicians get different permissions. Technician logins are restricted to their assigned work.
Abuse and request controls
Sensitive actions are limited, logged and challenged.
- Security request controlsVerification, recovery and other sensitive requests are rate limited and logged as security events.
- Bot protectionCloudflare Turnstile challenges automated signups and abuse where it is configured.
Legal evidence
A durable record of what each user accepted.
- Legal acceptance evidenceTerms acceptance and Privacy acknowledgement are stored in an append-only history with the document version and time. Later acceptances add rows; they never overwrite earlier ones.
Infrastructure and data handling
Managed services from established providers.
- Providers and infrastructureManaged cloud hosting, a managed Postgres database with authentication, and transactional and security messaging providers named in our Privacy Policy.
Where each responsibility sits
Every control above is in place today. Here is how the rest of the picture is divided.
- Card details are handled by Stripe, so card data stays with the payment processor.
- Live technician location is visible to authorized office roles when enabled, with the technician's device permission.
- Your team keeps its own exports of any records it is required to retain.
- Formal certifications are listed here only once they are earned and documented.
What your team should do
Security controls work best with good habits. Good habits make every control stronger. Start with the basics below and keep your own records.
- Turn on MFA for every office user.
- Give technicians restricted logins rather than shared office accounts.
- Remove access as soon as someone leaves.
- Keep recovery email and phone current.
- Keep your own exports of records you are required to retain.
To report a security concern, call 888-996-7770. See also the Privacy Policy and Terms of Service.
Run your next job in Roll On Call.
Start a 14-day free trial. No card required, and your first paid month is $25 off.
Plans from $59/month after the trial. Cancel anytime.