Security
Built like the money depends on it.
A job system holds your prices, your customers and your safety record. This page says plainly how Onyx One protects them. Every claim here is a control that exists in the product today.
Your business is isolated in the database
Every tenant's rows are separated by database row-level security, not by application code remembering to filter. A query from your account physically cannot return another business's records, and the client portal applies the same rule to your customers.
Roles are enforced where the data lives
Owner, admin, office, dispatcher, tech and contractor see different things because the database enforces it. Techs and contractors never see prices, costs or margins. Moving a permission check out of reach of the interface means a clever client cannot talk its way past it.
Sign-in that respects how crews work
Passwords are stored only as modern memory-hard hashes. Anyone can turn on two-factor codes, and a business can require MFA for everyone. Remember-me is a choice at sign-in, so a shared site tablet can run browser-session-only logins.
Credentials encrypted at rest
Your Xero connection grant is encrypted at rest and only owners and admins can see or touch the connection. Uploaded files live in private storage and are served only through authenticated routes that check your role first.
An audit trail that does not forget
Money movements, approvals, AI tool calls and administrative changes land in an audit log. Incidents can never be deleted by any role; there is no code path that removes one.
AI on a short leash
Your AI connects with the role of the person who connected it, never as an administrator. Tools are tiered: reads, safe writes, and sensitive writes that require a preview and a short-lived confirmation bound to that exact request. Every call is logged, and writes are idempotent so a retry never doubles up.
The boring, load-bearing basics
All traffic runs over HTTPS. Requests are checked for same-origin, rate limits protect sign-in and uploads, and file uploads are validated by content, not just by filename. Data lives in managed PostgreSQL over encrypted connections.
Your records stay yours
Financial and statutory records are retained for the life of your account, in line with New Zealand's seven-year record-keeping expectations. If you leave, your data leaves with you as exports, with a 30-day window after termination.
Found something?
If you believe you have found a security issue in Onyx One, email support@onyx1.app with the details. A person who built the system reads it, and we will respond, fix and credit responsibly. Please do not test against accounts or data that are not yours.
Be quoting this week.
Start a free trial and be quoting, scheduling and invoicing this week. No card, no sales call, no migration headache.
You create your account on onyx1.app. Fourteen days free, the full Pro feature set, no credit card.