Security and your data

Plain answers, no theater. Updated August 2026.

Where your data lives

Your jobs, customers, photos, invoices and books are stored on Cloudflare's global platform: records in Cloudflare D1 (a replicated SQL database) and photos in Cloudflare R2 object storage. Cloudflare encrypts data in transit and at rest. We run no servers of our own to be broken into.

Your customers' card details

We never see them, and we never touch their payments. Invoices are records you send and mark paid; the money moves however you and your customer arrange it. Your own subscription is billed by Stripe; your card number is held by Stripe, never by us.

Sign-in

There are no passwords to steal. Owners and office staff sign in with a one-click email link or a short-lived code. Crew sign in with a per-person code the owner can revoke at any time. Office sign-ins carry a role, every meaningful action is recorded with who did it, and deactivating a sign-in ends its sessions immediately.

Who can see what

Each business's data is isolated to that business, enforced on every query.
Crew phones see the jobs assigned to them, not your whole book of business, and never your money.
Dispatcher sign-ins run jobs and crew but cannot open Finance, invoices or settings.
We look at your account data only to support you, and we never sell it or use it for advertising.

Backups and leaving

The platform database is continuously replicated by Cloudflare, and we keep our own periodic exports. Your money, hours and invoice records are downloadable by you as spreadsheets at any time. If you cancel, your data is kept for 90 days in case you return, then deleted.

Found something?

If you believe you have found a security problem, email [email protected] with the details. A person reads it, and we fix real reports fast.

BookLocalWork and its trade editions are operated by SMCI Media, LLC.