Security

How your data is kept apart

Every firm's records are separated at the level of the data itself, not by a filter on a screen: your team's view of CanServe does not contain another firm's cases, invoices, or activity.

CanServe staff see what their role allows, and every staff action on your account is written to your own activity log, so you can see who at CanServe did what, and when.

A delivery partner sees a case only while that job is theirs. Before they accept, they see the address and the deadline; after the job ends, the details close to them again.

Signing in

Everyone has their own password, stored as a one-way hash that cannot be reversed. A first password is set from a one-time link that expires and works once.

Repeated wrong guesses lock an account out temporarily. Changing or resetting a password signs out every other device immediately.

Sessions end after inactivity: an hour in the customer portal, 30 minutes in the admin dashboard.

Files and records

Documents, field photographs, and signed proofs are stored outside the web, and are served only to people entitled to that case, one file at a time.

Uploads are checked: a file whose contents do not match the type it claims is refused, and stored files can never run code in your browser.

Data and backups sit on Canadian hosting, and backups are taken daily and kept for two weeks.

Payments

CanServe does not store card or bank numbers. Card details are handled by our payment processor; we keep only the brand, the last four digits, and the record of the payment.

Reporting a problem

If you believe you have found a vulnerability, email security@canserve.co with enough detail to reproduce it. We confirm within two business days and keep you updated until it is fixed.

Please do not access, change, or keep anyone else's data while testing, and give us 90 days before publishing.