Security overview

1. Every Workspace is separate

All records belong to a Workspace. Database row-level security rules check, for every read and write, that the signed-in person is a member of that Workspace. The rules are designed so that one business cannot read or change another business’s records, including through the programming interface.

2. Access and roles

• People sign in with an email address and a password of at least 8 characters. New accounts confirm their email address.
• Owners and Admins manage membership and settings. Only the Owner can delete a Workspace.
• Profit figures stay hidden from staff unless they are allowed to see them.
• Invitation links expire after 7 days and stop working once used.

3. Data in transit and at rest

All traffic between your device and EliteCinq is encrypted with HTTPS. Data is stored with our database provider, Supabase, whose platform encrypts stored data and keeps backups. The website is delivered by Cloudflare.

4. Hardened web application

• A strict content security policy allows scripts only from EliteCinq itself. There are no third-party scripts, advertising tags or analytics trackers.
• Fonts and libraries are served from our own site.
• Pages cannot be framed by other sites, browsers are told not to guess file types, and links do not pass referrer information.
• Exported spreadsheet cells are protected against formula injection.

5. What you should do

• Use a strong, unique password and do not share Accounts.
• Invite only the people who need access, give them the lowest role that works, and remove people who leave.
• Share invitation links only with the intended person.
• Keep the devices you use updated and locked, and sign out on shared computers.
• Store exported files and printed invoices securely.

6. Reporting a security issue

If you believe you have found a vulnerability, please tell us privately, give us reasonable time to fix it before disclosing it, and do not access other people’s data or disrupt the Service while investigating.