- Home
- Security
Trust center
Security you can explain to a utility procurement team.
Every control on this page is implemented in the product and verified by automated tests in CI. Where something is not in place yet, we say so.
United States only
Primary databases, object storage, encrypted backups, application logs and transactional email processors run in us-east-2. The application refuses to start if a non-US region is configured. There is no non-US, on-premises or single-tenant option.
Enforced by the database
Every firm-owned table carries a required tenant ID with PostgreSQL row-level security enabled and forced. The application connects as a role that cannot bypass it, and a query without a tenant context returns nothing. CI checks every endpoint across two tenants and blocks any migration that adds an unprotected table.
SSO, MFA and sessions
Sign in with Google Workspace or Microsoft Entra ID. Firm admins can require MFA for everyone; sign-ins without verified MFA are rejected and audited. Session tokens are stored only as SHA-256 hashes. People can review and revoke their own sessions; admins can revoke all of a person's sessions at once, and deactivating a user revokes them automatically.
Roles, enforced in the API
Six built-in roles, each endpoint declaring which roles may call it, tested for every role in CI. Cost and bill rates, dollar values and margin are removed in the API for anyone without financial access, which firm admins grant per person. Status visibility follows project assignment and the reporting line.
Append-only, by design
Changes to people, roles, rates, templates, SOWs, estimates, approvals, client links, sessions, imports and exports write an audit record with actor, action, object, before and after values and a UTC timestamp. Database triggers reject edits and deletes of audit records, even from the application.
Locked baselines
Approval stores a hash of the exact client-visible content and lines; sending fails if anything changed. Signed estimate versions are locked and sealed with a SHA-256 content hash, and a database trigger blocks changes to their lines. Scope changes require a change order.
Encrypted, backed up, restore-tested
TLS 1.2+ in transit; AES-256 at rest for databases, backups and file storage. Daily backups with continuous write-ahead log archiving. Recovery point objective 24 hours or less; recovery time objective one business day or less. Backup and restore is verified by an automated round-trip test.
Exportable at any time
Firm admins can download a complete JSON archive of the firm's data and CSV exports whenever they want. After you leave, your data stays exportable for 30 days and is then permanently deleted. Stafio uses no third-party analytics or ad trackers, and customer data is never used to train AI models.
Data we do not collect
Stafio does not process Social Security or government ID numbers, bank or payroll routing numbers, payment card data, protected health information, or behavioral advertising profiles.
Run your next weekly cycle in Stafio.
Setup is designed to take under an hour, with starter templates for people, projects and history.