Security

Earl handles people's schedules and their money, so it is built and reviewed against the standards the security community uses, and we say plainly what that means.

OWASP publishes these standards; it doesn't certify products. These badges mean Earl's code has been reviewed against each one, item by item, and the findings fixed. The review is repeated as Earl changes.

What that means in practice

Every business is walled off

Each business's records live behind row-level security in the database. The app connects as a role that can only see the business it is acting for, on every query, not just the ones we remembered to filter.

Sign-in without passwords

Your phone number and a texted code, or a passkey (Face ID, Touch ID, a security key) that can't be phished. Sessions can be signed out from any device, and they expire on their own.

Earl can't be talked into things

Words that arrive from outside the business, an email, a text, a caller, a web page, are marked as information, never as instructions, and stay marked every time they come up again. Earl only emails or texts someone you named, and a new address waits for your tap.

Employees never see money

Rates, pay, invoices, quotes, and costs are stripped out for employees at the source, in every screen, every sheet, every export, and every phone call.

Payments never touch us

Card and bank payments run on Stripe. Your customers' card details never reach Earl's servers, and the money goes straight to your own Stripe account.

Backups you can actually restore

Encrypted copies of every business every night, kept off the database host, and a restore drill that has been run, not just planned.

Spending has a ceiling

Each plan has a monthly allowance for the work Earl does, so a stolen login can't run up a bill, and a failing provider is cut off rather than hammered.

Watched around the clock

Health checks, a heartbeat from the worker, alarms when a backup is late or the queue backs up, and a request id on every error so a report can be traced to its cause.

The three standards

OWASP ASVSVerification standard, Level 2 controls
OWASP Top 10The ten web risks, 2021 edition
OWASP LLM Top 10The ten AI risks, 2025 edition

Your data

It's yours. Export it any time as spreadsheets, close the business and everything is deleted, and nothing is sold or used to train models.

The details, including who processes what, are on the privacy page. Found something? Email security@earl.solutions.