Security
Earl handles people's schedules and their money, so it is built and reviewed against the standards the security community uses, and we say plainly what that means.
OWASP publishes these standards; it doesn't certify products. These badges mean Earl's code has been reviewed against each one, item by item, and the findings fixed. The review is repeated as Earl changes.
What that means in practice
Each business's records live behind row-level security in the database. The app connects as a role that can only see the business it is acting for, on every query, not just the ones we remembered to filter.
Your phone number and a texted code, or a passkey (Face ID, Touch ID, a security key) that can't be phished. Sessions can be signed out from any device, and they expire on their own.
Words that arrive from outside the business, an email, a text, a caller, a web page, are marked as information, never as instructions, and stay marked every time they come up again. Earl only emails or texts someone you named, and a new address waits for your tap.
Rates, pay, invoices, quotes, and costs are stripped out for employees at the source, in every screen, every sheet, every export, and every phone call.
Card and bank payments run on Stripe. Your customers' card details never reach Earl's servers, and the money goes straight to your own Stripe account.
Encrypted copies of every business every night, kept off the database host, and a restore drill that has been run, not just planned.
Each plan has a monthly allowance for the work Earl does, so a stolen login can't run up a bill, and a failing provider is cut off rather than hammered.
Health checks, a heartbeat from the worker, alarms when a backup is late or the queue backs up, and a request id on every error so a report can be traced to its cause.
The three standards
Your data
It's yours. Export it any time as spreadsheets, close the business and everything is deleted, and nothing is sold or used to train models.
The details, including who processes what, are on the privacy page. Found something? Email security@earl.solutions.