FacilityCare IQSecurity
What happens to a cleaning company's data once it is in FacilityCare IQ, stated plainly. No certification is claimed here that we do not hold.
Where the data lives
The database, file storage and sign-in run on Supabase in the European Union (Paris region). The website and the web dashboard are served by Vercel. Data is encrypted at rest by the hosting provider and backed up by it on its own schedule.
Encryption in transit
Every connection from the website, the dashboard and the phone app uses TLS. Links in emails are HTTPS only.
One company cannot see another
Each company's rows are isolated with row-level security in the database: a request only ever returns data belonging to the signed-in person's company, and within it only what that person's role allows (owner or manager, cleaner, contractor, client).
Sign-in without passwords
People sign in with a one-time code sent to their email address, valid for ten minutes. We store no passwords, so there are none to leak. Sign-out on a phone also removes that phone's push registration.
Location and photos
Location is read only at check-in and check-out and stored with that visit; the app has no background location permission. Photos are off unless a site asks for them, and they are stored privately with the visit.
Payments
Card details never reach our servers: web subscriptions are handled by Stripe, phone subscriptions by the App Store and Google Play. Invoices your company sends carry your own payment details; no money passes through FacilityCare IQ.
Export and deletion
Timesheets export to CSV and invoices to PDF at any time. An owner can delete the company's account from Settings; personal data is removed within 90 days (see Data Deletion).
Subprocessors
Supabase, Vercel, Resend, Expo, Stripe, Apple, Google, Xero (only when connected) and Anthropic (only for scope-of-work import). The Privacy Policy says what each one does.
Reporting a vulnerability
If you find a security problem, write to support@facilitycareiq.com with the steps to reproduce it. We reply within two working days and do not take action against good-faith reports.