Your numbers stay yours
Last updated 10 September 2026
Contractors do not hand over job costs, margins and customer lists lightly. Here is exactly how that data is handled, in plain terms, with no claims we cannot back up.
Separated by company
Every request is checked against the company that owns the record. One contractor cannot see another's jobs, costs, customers or documents. That separation lives in shared code used by every route rather than being written again each time, and an automated test suite runs against a real database to prove it still holds after every change we make.
Encrypted in transit and at rest
Every connection to CrewCadence is encrypted with TLS. Documents you upload are stored on Cloudflare R2 and encrypted at rest with AES-256. They are only reachable through links that expire five minutes after they are created, so a copied link is useless shortly afterwards.
Passwords nobody can read
Passwords are hashed with bcrypt before they are stored. Nobody at CrewCadence can read yours, including David. If you forget it you get a one-time reset link that expires in an hour, never the password itself. Password reset gives the same response whether or not an account exists, so it cannot be used to find out who has one.
Your crew sees the work, not the money
Field accounts are a separate kind of login. A foreman sees quantities, hours and the schedule. Every dollar figure is removed before it reaches his phone, on the server rather than hidden in the screen, so budgets and margins never leave your office.
Sessions that expire
Signing in lasts seven days, not the month most software defaults to. A phone left in a truck cab on a jobsite is a real risk, and a shorter window is the honest answer to it.
Never sold, never shared
Your company data, your customers, your subcontractors and your costs are yours. They are not sold, not shared with other contractors or general contractors, and not used to build anything anyone else can see.
About David's access
CrewCadence is a small company and David runs the systems, which means he can technically reach the database. That is true at every software company this size. The rule is simple: he does not look at your job data unless you ask for help with something specific, and if he needs to look in order to fix a problem, he will tell you.
If another vendor tells you their staff can never see your data, ask them who restores the backup.
What we have not done
We would rather tell you this than have you find out later.
- No SOC 2 report and no third-party penetration test. Neither has been done. Any vendor our size claiming otherwise is worth a second look.
- No two-factor authentication yet. Email and password is the whole gate today. It is on the list.
- No audit log yet. The system does not currently record who changed a figure and when. That matters more once several people in your office share an account, and it is planned for the release that adds roles.
Reporting a problem
If you find a security problem, email david@tripleccoaching.com or call 303-887-5369. You will get a reply the same day. We will not threaten anyone who reports a genuine issue in good faith.