Security at RingBack

For property managers and IT reviewers. Questions: support@ringbackllc.com

Your data stays yours, and separate

Every record (ticket, unit, user, vendor, photo and message) belongs to exactly one company, and every database query is filtered by it. Automated tests confirm that one company can't see or change another company's data, even by guessing web addresses or record numbers. These tests run before every release.

Access by role

Owners, admins, managers, technicians and vendors each see only what their role needs. Technicians see only jobs assigned to them. Vendors see only jobs sent to their company and never staff-only notes. Deactivating a user signs them out everywhere at once and unassigns their open work.

Accounts and passwords

• Passwords are stored only as salted one-way hashes. Nobody at RingBack LLC can see them.
• Password reset links expire after one hour, work only once, and are stored hashed.
• Repeated failed sign-ins are slowed down automatically.
• Changing a password signs out all other sessions.

Protection in transit and in the app

• All traffic is encrypted with HTTPS.
• Every form is protected against cross-site request forgery.
• Session cookies are HTTP-only and secure.
• Uploaded photos are checked to be real images, stripped of hidden location data, and shown only to signed-in users allowed to see that ticket.

Backups and monitoring

• The database is backed up automatically every day, and copies are stored off the server.
• Restores are tested regularly.
• Server errors and downtime alert our team immediately.

Payments

Card payments are handled by Stripe, a PCI Level 1 certified provider. Card numbers never touch our servers.

Text messages

Texts go only to people who opted in, and every recipient can reply STOP. We never send marketing texts or share phone numbers for marketing. Every email and text is recorded in a message log your admins can review.

Service providers

We use established providers:

• Render (hosting)
• Postmark (email)
• Twilio (texts)
• Stripe (payments)

Each processes data only to provide its service to us.

Your data, your exit

Admins can export all tickets, units and history to spreadsheets at any time. When an account closes, data stays available to export for 30 days and is then deleted within 90 days.

Reporting a problem

If you believe you've found a security issue, email support@ringbackllc.com. We'll respond quickly and keep you updated.