Features / Security and privacy
Security and privacy
Your data stays yours, and separate
Every company's records are kept apart by the database itself, not just by the app. Owners sign in with two-step codes, keys are encrypted, and every change is written to an audit trail.
Included in: Pro and up Compare plans

What it does
- Separate by designPostgreSQL row-level security on every company table: a request can only ever see its own company's rows. Fishtape staff access to a company is granted, time-limited and logged.
- Sign-inPasswords hashed with argon2id, two-step codes required for owners and admins, lockouts after repeated failures, and PINs for crew on a shared iPad.
- Keys and secretsYour Stripe, email, SMS and AI keys are encrypted with AES-256-GCM and never sent back to the browser.
- Audit trail and exportEvery change is recorded with who, what and when, in a tamper-evident chain. Export your data any time; downgrading never deletes it.
How it works on site
- Turn on two-step sign-in when you first sign in (owners and admins must).
- Give each person the role they need: office, foreman, electrician, apprentice.
- Review who has access in the Security screen.
- Export a full backup whenever you like.

Which plan includes it
Every plan has no caps on invoices, estimates, jobs, clients or drawings. Plans differ by features and included users.
- Security audit screenPro and up
- Single sign-onEnterprise
Good to know. Fishtape follows SOC 2-aligned policies but has not had a formal SOC 2 audit. The data-centre location for production will be published here before launch. Single sign-on is on Enterprise. Found a security problem? See our security.txt.
Try it on your next job
14 days free on the plan you pick. A $1 deposit confirms your card and comes off your first month. Cancel before the trial ends and the plan is never charged.