Security you can explain to your clients.

How we keep Pendira safe

This page lists our security controls in plain words, so you can answer your own clients and fill in supplier questionnaires faster. Pendira is made by AGByte Labs in the Netherlands.

Where your data lives

• The servers that run Pendira and the database that holds your jobs, teams and records are hosted in the EU.
• Photos, signatures, receipts and documents are kept in private storage under EU jurisdiction.
• Every company that helps us run Pendira is named on our sub-processors page, with what it does and where.
• Text messages and emails travel through their delivery providers. We list each provider before it carries your messages.

Who sees what

• Five ready-made roles (Admin, Manager, Coordinator, Finance and Viewer), 38 permissions and custom roles.
• Every request is checked against the person's permissions and the clients they may see.
• Prices, rates and margins are removed by the server for anyone without permission, so they cannot leak through a screen or an export.
• Nobody can give a permission they do not have. The Admin role cannot be changed, and every company always has an Admin.
• Each company's data is kept apart. Every record carries its company, and every query is limited to it.
• Your engineers, clients and rates are never shown to another company. Pendira is not a marketplace.

Sign-in

• Two-factor sign-in with an authenticator app and recovery codes, required by default for new companies.
• Five failed passwords in 15 minutes lock sign-in for that email for 15 minutes.
• Passwords are stored only as argon2id hashes. New passwords are checked against common and leaked passwords, without the password leaving Pendira.
• Sessions live in secure, HttpOnly cookies, never in a link.
• Sensitive changes ask you to sign in again if your last sign-in was more than 10 minutes ago.
• You can sign out of every device at once.
• Sign-in, links and codes are rate limited per address.

Engineer phone links and guest links

• Each engineer link is a long random token, stored only as a keyed hash.
• A 6-digit code, sent only to the phone on the engineer's profile, opens the link. A code lasts 10 minutes and allows 5 tries.
• An engineer sees only their own offers, work orders, rate and extra costs. Never your price, your client's name, other engineers or internal notes.
• Guest links are read-only and expire after 1 to 90 days. You can revoke one at any time, and it stops working at once.
• A guest link shows status, schedule and proof. Never prices, contact details or notes.

Files

• Photos, signatures and receipts are private. Links to them expire within minutes.
• Every upload is checked for its type and size. A file that does not match is deleted.
• Uploads that are never completed are deleted after 24 hours.

Encryption

• All traffic to Pendira uses HTTPS.
• Your database and files are encrypted at rest.
• Two-factor secrets are encrypted. Links, codes and session tokens are stored only as keyed hashes.
• Request logs keep their contents encrypted and expire after 90 days.

Every change logged

• Every change records who, when, and the value before and after.
• The activity log is append-only. Corrections never overwrite the original.
• Sign-ins, failed attempts, lockouts and two-factor changes are recorded as security events.
• When our team changes something in your company, such as your plan, it shows in your activity log.

Our own access

Our team works in your data only to set up your company, keep Pendira running or help when you ask. We never sell your data, and we use it for nothing but running Pendira for you.

What we do not claim

Pendira does not hold ISO 27001, SOC 2 or any other security certification today. Our providers' certificates are theirs, not ours. We are GDPR compliant, and we sign a data processing agreement with every customer.

Report a security issue

If you find a weakness in Pendira, write to hello@pendira.com. Please give us time to fix it before you share it. A person on our team reads every message.