Security at Tuyyo

• Every business's data is separated by rules inside the database itself, so one business can't read another's.
• Your team sees only what their roles allow, and the database enforces it, not just the screens.
• Card and bank details go straight to Stripe; Tuyyo never sees or stores them.
• Data travels over HTTPS and our providers encrypt it where it is stored.
• Only the operator can reach the production systems, and only the operator changes the production database.
• Some things are not in place yet — daily backups among them. They are listed under “Planned” below.

Every table that holds business data has row-level security switched on: the database itself checks, for every read and write, that the person asking belongs to the business that owns the row. A signed-out visitor can read nothing at all. Automated tests check that every table has these rules, that signed-out visitors are refused everywhere, and that one test business can’t reach another’s records.

• The account owner has every permission. Everyone else gets roles — Office manager, Crew lead, Crew, Bookkeeper, or roles you create — and can do only what those roles allow.
• Permissions are enforced by the database on every request; the app checks them too and hides what a role can't use. Hiding a button is never the only protection.
• People whose roles can't see money don't see prices or totals in the app. Hiding them from direct database access as well is planned.
• Nobody can give themselves, or anyone else, more than they already have. Every change to roles is written to your activity history.
• Notes and files are for your team only; your clients never see them.

• Sign-in is handled by our database provider, Supabase. Passwords are stored hashed by Supabase; Tuyyo never stores or sees them.
• Two-step sign-in for Tuyyo accounts is not available yet.
• Pages inside the app need a signed-in session; everything else (this page, the Terms, the Privacy Policy) is public.

• In transit: tuyyo.io is served over HTTPS only, with HTTP Strict Transport Security, so browsers refuse an unencrypted connection.
• At rest: the database and stored files are encrypted by Supabase. Supabase’s own security page says: “All customer data is encrypted at rest with AES-256 and in transit via TLS.”
• The site sends headers that stop other websites from framing Tuyyo's pages (protection against clickjacking) and stop browsers from guessing file types.

• Files your team uploads (up to 25 MB each) and the signatures your clients draw are kept in private storage. Opening one creates a link that works for a few minutes (5 for files), and only someone allowed to see the record the file belongs to can get one.
• Your business logo is the exception: it is public, because it appears on the quotes and invoices you send.
• Each business has a storage limit, and unfinished uploads are cleaned up automatically every day.
• Your clients open quotes and invoices through private links that expire (30 days for a single document, 90 days for a client's link to all their documents). Anyone who has a link can open it, so clients shouldn't forward them.

Online payments run on each business’s own Stripe account (Stripe Connect). Card and bank details go directly to Stripe; Tuyyo receives only the amount, the payment method type and the payment status. Stripe’s security page says a PCI-certified auditor “certified us to PCI Service Provider Level 1”. During the beta, online payments run in Stripe’s test mode.

• Your activity history can be added to but never edited or deleted from the app — not even by the account owner.
• Document numbers, totals, payments, amounts paid and balances can be changed only through fixed database functions that check who is asking, never by editing a row directly.
• Clients are archived, not deleted; sent quotes and invoices can be voided but not deleted.

• Tuyyo is operated by Wilber Ventura, doing business as Tuyyo. Only the operator has administrator access to the production systems.
• Changes to the production database are made only by the operator, with a deliberate confirmation step. Development and testing use a separate database with test data only; our development tools, including AI coding assistants, are never given production credentials.
• Code changes are made on a separate branch and run automated checks (type checks, linting, unit tests and a full build, plus database security tests); they reach production only when the operator merges them.
• Errors in the app are reported to Sentry so we can fix them quickly. Error reporting is configured to leave out the personal details Sentry could otherwise attach (such as IP addresses, cookies and the contents of requests), and we don't record sessions or screens.
• tuyyo.io runs no analytics or advertising trackers.

We’d rather tell you plainly: during the beta, the production database runs on Supabase’s free plan, which does not include automatic daily backups. Moving production to a paid plan with daily backups, followed by a test restore, is planned — it is a requirement before Tuyyo leaves the beta.

These companies hold or carry data to run Tuyyo. Each publishes its own security information; we don’t repeat their claims beyond what is quoted on this page.

• Deleting a note hides it rather than erasing it, so it can be recovered after a mistake. Deleting a file removes the stored file itself. A deleted team message keeps no text.
• To export your data or delete your account, email us (below). We answer within 30 days and delete as described in our Privacy Policy. A self-serve export and deletion screen is planned.

• Daily database backups and a tested restore (paid database plan).
• Two-step verification required on every administrator account Tuyyo uses (code hosting, hosting, database, payments, email).
• A log of who opened each sensitive file, and stricter handling for sensitive documents such as tax records — for tax and bookkeeping businesses.
• Prices and totals hidden from direct database access for roles that can't see money, not only in the app.
• A stricter content security policy (it runs in report-only mode today).
• Self-serve data export and account deletion.
• An independent security audit (SOC 2) once customers need one.

Tuyyo itself has not been through an independent security audit and holds no certification such as SOC 2 or ISO 27001. We write our practices down as if we were preparing for one, and we’ll start the audit when a customer or partner needs it. If you run a tax or bookkeeping practice and need to describe Tuyyo in your own written information security plan, ask us and we’ll send you what we can.

Found a security problem, or have a question about this page? Email us at support@tuyyo.io. We read every message.

Please give us a reasonable chance to fix a problem before you share it, and don’t access other people’s data while looking. If a security incident affects your data, we will tell you as the law requires. These practices sit alongside our Terms of Service and Privacy Policy.