Security

Security is part of the architecture

Toolbase holds your customers, pricing and financial performance. This page explains how that data is separated, who can reach it and how access is recorded.

Ask a security question

Data separation

Your business is isolated from every other

  • Multi-tenant isolation

    Every record belongs to one tenant, and every request is scoped to the tenant of the signed-in user.

  • Separate marketing and application

    This website has no access to the Toolbase database. The application runs on separate infrastructure.

  • Multi-company structures

    Businesses with more than one company can keep each company's data separate under one account.

Access control

Permissions down to the action

  • Role-based permissions

    Roles such as administrator, manager, salesperson and technician decide what each person can do.

  • Module-level permissions

    Access is granted per module, so a technician does not need to see commissions.

  • View, edit and delete permissions

    Viewing, changing and deleting records are controlled separately.

  • Authentication

    Passwords are stored hashed, with email verification and secure password reset.

  • Session security

    Sessions expire, can be revoked, and single-session controls can be enabled where required.

  • Audit logs

    Sign-ins and changes to records are logged with the user, time and what changed.

Platform

Protecting the platform itself

  • Encryption

    Data is encrypted in transit using TLS. Sensitive credentials such as integration secrets are encrypted at rest.

  • API security

    API and MCP access is authenticated, permission-checked and rate limited. Keys can be revoked.

  • AI permissions

    AI assistants act as the signed-in user and are subject to the same tenant, role and module limits.

  • Infrastructure security

    The application is hosted separately from this website, with access to production restricted.

  • Backups

    Application data is backed up on a regular schedule.

  • Monitoring

    The platform is monitored for errors and availability so problems are found early.

Certifications

What we hold, stated plainly

Toolbase does not currently hold the certifications below. We list them so you can see where we are, and we will only show a status here once it has been independently verified.

  • ISO 27001

    Not currently held

  • SOC 2

    Not currently held

  • Essential Eight alignment

    Not currently held

Related

Have a security questionnaire?

Send it through and we will answer it directly.

Contact usBook a Demo