Built like the money depends on it.
A job system holds your prices, your customers and your safety record. Here is how ONYX1 protects them. Every claim here is a control that exists in the product today.
Your business is isolated in the database
Each business's records are kept apart by row-level security in the database, not by app code remembering to filter. A query from your account cannot return another business's records, and the client portal applies the same rule to your customers.
Roles are enforced where the data lives
Owner, admin, office, dispatcher, site supervisor, tech and contractor see different things because the database enforces it. Techs and contractors never see prices, costs or margins. Tampering with the app cannot get anyone past that check.
Sign-in that respects how crews work
Passwords are stored only as modern memory-hard hashes. Anyone can turn on two-factor codes, and a business can require MFA for everyone. Remember-me is a choice at sign-in, so a shared site tablet can run browser-session-only logins.
Credentials encrypted at rest
Your Xero connection grant is encrypted at rest, and only owners and admins can see or touch the connection. Uploaded files live in private storage and are served only through authenticated routes that check your role first.
An audit trail that does not forget
Money movements, approvals, AI tool calls and administrative changes land in an audit log. Safety incidents can never be deleted by any role. There is no code path that removes one.
AI on a short leash
Your AI connects with the role of the person who connected it, never with more access than that person has. Tools are tiered: reads, safe writes, and sensitive writes that need a preview and a short-lived confirmation bound to that exact request. Every call is logged.
The boring, load-bearing basics
All traffic runs over HTTPS. Requests are checked for same-origin, rate limits protect sign-in and uploads, and file uploads are validated by content, not just by filename. Data lives in managed PostgreSQL over encrypted connections.
Your records stay yours
Financial and statutory records are retained for the life of your account, in line with New Zealand's seven-year record-keeping expectations. Export your data any time. For 30 days after your account closes, ask us for it.
Found something?
If you believe you have found a security issue in ONYX1, email support@onyx1.app with the details. A person who built the system reads it, and we will respond, fix and credit responsibly. Please do not test against accounts or data that are not yours.
For how we handle personal information, read the Privacy Policy.
The whole job. One app.
Your next job.
Sorted.
Try the whole job, from first call to final invoice.