Security

Effective October 23, 2026 · Gulf Coast Systems Technology LLC · support@cintos.app

CINTOS holds your jobs, drawings, photos, crew time and quotes. This page explains, in plain words, how we protect them. Questions from your IT or security team are welcome at support@cintos.app.

Each company’s data is walled off

• Every table in the database has row-level security: the database itself refuses to return one company’s records to another company, even if a page had a bug.
• Inside a company, roles decide what each person can see and do (owner, admin, PM, foreman, crew, warehouse, read-only), and every request is checked on the server, not just hidden in the menus.
• Files (drawings, photos, documents) are in private storage and opened through short-lived links.

Sign-in and access

• Sign-in is handled by Supabase Auth; CINTOS never stores passwords in plain text.
• Crew day links are long random codes (192 bits), work only for that job and day, can be revoked at any time, and hide themselves from other websites.
• API keys are stored hashed; connected-service tokens (Procore, QuickBooks, Autodesk, Smartsheet, Bluebeam) are encrypted before they are saved and are deleted when you disconnect.
• An activity log records who changed what.

In transit and at rest

• All traffic uses HTTPS, and browsers are told to always use it (HSTS).
• The app is hosted on Vercel; the database and files are on Supabase, which encrypts them at rest.
• Card payments are handled entirely by Stripe — card numbers never touch CINTOS.
• Secret keys live only on the server, never in the browser or in our code.

In the browser

• Pages can’t be framed by other websites (protection against clickjacking), and browsers are told not to guess file types.
• Camera, microphone and location are only available to CINTOS itself, and only when you use a feature that needs them.
• A content security policy limits where scripts may load from (being rolled out in stages).

AI features

When you use an AI feature, only the content that task needs (for example a note, a photo or one drawing page) is sent to the AI provider to produce the result. See section 4 of the Privacy Policy.

How we keep it working safely

• Automatic tests and a secret-key scan run on every code change before it goes live.
• A nightly test signs in as a test company and runs the main workflows end to end.
• A daily self-check confirms the database, storage, email and AI services are healthy; errors people hit are logged and reviewed.
• Libraries are checked weekly for known security problems and updated.
• Abuse limits on public endpoints (sign-up demo, website chat, error reports).

Reporting a problem

If you think you’ve found a security issue, email support@cintos.app with the details. Please don’t access other people’s data or disrupt the service while testing. We’ll reply quickly and keep you updated while we fix it.

Gulf Coast Systems Technology LLC · cintos.app