Security and your data

On behalf of a shop using RVDesk:

• Shop records — business name and address, labour and tax rates, staff accounts and their permissions.
• Customers and vehicles — names, phone numbers, email addresses, postal addresses, and the RVs they own.
• Work — work orders, estimates, inspections, parts, labour, purchase orders and invoices.
• Money — what was invoiced, what was paid, by which method, and when.
• Messages — the email and text messages a shop sends its customers, their replies, and the record of consent.
• Business identity for text-message registration — where a shop registers to send texts, the legal business name, business type, registered address, a named representative, and a tax ID or verification mobile number.

Card numbers and bank details.Card payments run through Stripe using the shop's own Stripe account. Stripe collects the business details, bank account and identity verification directly, and the money settles to the shop's bank. RVDesk never sees or stores a card number, CVC or bank account number. What we keep against a payment is the amount, the method, the card brand and last four digits, and Stripe's own reference so the two records can be reconciled.

Passwords.Authentication is handled by our database provider's auth service. Passwords are hashed there and never reach RVDesk's own tables. We cannot read a password, and neither can support.

• In transit — every connection to RVDesk and to our database is over HTTPS/TLS. There is no unencrypted route into the application.
• At rest — the database is encrypted at rest by our hosting provider at the storage layer.
• Separation between shops — this is the one that matters most in shared software. Every table carrying shop data enforces PostgreSQL row-level security, so a query made by one shop cannot return another shop's rows even if the application asked it to. It is enforced by the database rather than by application code remembering to filter.
• Roles inside a shop — permissions are enforced on the server, not by hiding buttons. A technician cannot reach payroll or a tax ID by calling the API directly.
• Backups — the database is backed up by our hosting provider on a rolling basis.

Storage-layer encryption protects the data if someone walks off with a disk. It is not the same as encrypting individual columns, and we do not claim it is. In particular, a shop's tax ID is stored as an ordinary column value, protected by row-level security and restricted to the owner and managers of that shop. It is never returned to a browser in full — screens that reference it show only the last four digits — and it is never written to logs. But it is readable by our infrastructure, as any operational database is.

We would rather write that down than describe it in a way that sounds stronger than it is.

We do not sell data, and we do not share it for anyone else's marketing. Data reaches a third party only where that party performs a function the product needs:

• Database, authentication and file storage — where shop data lives.
• Application hosting — serves the application.
• Stripe — card payments and RVDesk's own subscription billing.
• Twilio — carries text messages and the carrier registration behind them.
• Resend — delivers email to customers on a shop's behalf.

Mobile information and messaging consent are not shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are never shared with, or sold to, anyone. See the Text Message Program for how consent is collected and how a customer stops messages.

A shop's data belongs to that shop. We hold and process it to run the product on their behalf. A shop can export its records at any time from within the application, and can ask us to delete its account and data by writing to support@rvdesk.net.

Where a shop's own customer asks about the information a shop holds on them, that request is properly directed to the shop, since the shop decides what to collect and why. We will help a shop answer it.

If you believe you have found a security problem in RVDesk, email support@rvdesk.net with enough detail to reproduce it. Please give us a reasonable opportunity to fix it before disclosing it publicly. We will not pursue anyone who reports a genuine issue in good faith and does not access or alter data belonging to someone else.

Privacy Policy · Terms of Service · Text Message Program