Encrypted transport
Production browser, API, webhook, and background traffic is served over HTTPS with modern TLS termination through managed hosting infrastructure.
Barker security posture
Security
Barker protects company operations data, customer records, estimates, jobs, documents, payments, worker access, and secure customer links with tenant boundaries, scoped roles, audit evidence, and managed infrastructure controls.
Encrypted storage
Managed database and object-storage providers encrypt persisted data at rest. Connected document providers may also store customer-selected files under the company's own provider account.
Authentication controls
Company users use server-side sessions and httpOnly cookies. Passwords are hashed with a memory-hard KDF. Worker access uses scoped phone/SMS login for assigned field work.
Role boundaries
Owner, Admin, Sales, and Worker roles are separated. Workers are scoped to assigned jobs and do not see pricing, payment history, broad CRM history, or unrelated jobs by default.
Tenant boundaries
Core Barker records are company-scoped. Sensitive actions such as user changes, payments, exports, permission updates, and customer-link events are designed to write audit evidence.
Secure customer links
Customer-facing estimate, document, and payment access uses purpose-specific signed links instead of reusable customer portal accounts in the first version.
Incident response
Confirmed incidents are assessed for scope, containment, customer notice, and legal obligations. Production readiness includes final provider, key-rotation, and live-smoke checks.
Security review
Barker launch work is tracked through auditable implementation slices with targeted tests, route scans, and product/security review before production use.
Responsible disclosure
Report suspected vulnerabilities to security@barkercrm.com. Include the affected URL, reproduction steps, impact, and any non-sensitive proof of concept. Do not access, modify, or exfiltrate data that does not belong to you.