Security at TradeFlo
Product baseline · September 2026
Workspace isolation
Contractor records are accessed through authenticated server functions that verify the signed-in user, active Membership, company and role. Direct custom-entity access is restricted to the platform administrative boundary.
Customer links
Proposal, change-order and invoice customer pages use narrow secure-token endpoints rather than exposing contractor workspace data.
Payments
Payment-card information will be handled by connected payment processors rather than stored directly in TradeFlo application records.
Responsible disclosure
If you believe you found a security issue, contact the TradeFlo team with steps to reproduce it and do not access or modify data that does not belong to you.
This product-language baseline should be reviewed by qualified counsel before material commercial scale or expansion into additional jurisdictions.