Security practices for Service Arc
Built for multi-tenant field operations — with clear boundaries between organizations and careful control inside yours.
Service Arc is operated by Aether Mind Studios LLC on Google Firebase / Google Cloud.
Firebase platform
We use Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Messaging (mobile), and Firebase Hosting. Privileged actions (invites, billing hooks, quota, weather fetch) run in Cloud Functions where appropriate.
Cloud Firestore
Operational records live in Firestore. Security rules and organization IDs keep tenants separated. Clients and trusted functions only access data for organizations the user belongs to.
Cloud Storage
Photos, documents, and uploads are stored in Cloud Storage under organization-scoped paths with rule-based access and managed upload paths.
Authentication
- Email / password for staff
- Email verification and password reset
- Custom tokens for staff invite acceptance
- Customer Portal magic-link style sessions for end customers
Google Sign-In and Apple Sign-In are not offered today.
Password security
Passwords are handled by Firebase Authentication (never stored in our application database as plaintext). Use a unique password. Administrators should promptly disable accounts when staff leave.
RBAC
Roles and permissions control who can manage billing, invite staff, edit customers, close locates, or change workspace settings. Enforce least privilege inside your organization.
Audit logging
Significant operational activity is recorded so supervisors can reconstruct what happened — status changes, investigations, and administrative actions.
Encryption
TLS in transit. Google Cloud encryption at rest for Firestore and Storage.
Backups
Durability follows Google Cloud practices plus our operator backup / recovery procedures. Backups may retain copies briefly after primary deletion.
MFA roadmap
Multi-factor authentication for staff is on our roadmap. Today, protect accounts with strong unique passwords and careful invite hygiene. Enterprise needs can be discussed with sales.
Session management
Staff sessions follow Firebase Auth session behavior. Portal sessions are short-lived relative to email magic links and should be treated as sensitive.
Invite security
Staff invites use server-issued tokens and expire. Do not forward invite emails casually. Revoke unused invites and remove former employees promptly.
Document permissions
Documents attach to operational records under organization scope. Permission checks apply for view and upload paths used by the product. Administrators remain responsible for who has elevated access.
Customer Portal security
End customers receive limited access through grants you control (for example viewing or paying invoices). Portal users do not receive staff administrative access.
Data isolation / organization isolation
Tenants are isolated by organization ID across Firestore and Storage rules. Cross-tenant browsing is not part of the product design.
What we do not claim
We do not claim SOC 2, ISO 27001, or HIPAA readiness by default. Service Arc is not intended for PHI unless a separate BAA is executed.
Report vulnerabilities: security@servicearcapp.com
Broader trust overview: Trust Center