Your data, and your customers', protected by the database itself
Customers, jobs, messages and payment records live in Tilow. This page sets out, in plain terms, the security and privacy controls in place today. We list what we do, not what we plan to do.
Last reviewed 28 September 2026.
Every business’s data is walled off from every other
Many repair businesses share Tilow, so keeping one business’s records invisible to the next is the most important thing we do. The separation is enforced by the database itself, not only by the app on top of it.
Separated inside the database
Every record is tagged to one business, and the database refuses to return it to anyone else, for reads and writes alike.
Tested around the clock
An automated test signs in as one business and tries to read another’s data, about every two hours. It also checks that each staff role can do only what it is allowed to.
Nothing public without a login
Apart from the prices and listings a business publishes, nothing is reachable without signing in. We check the whole public surface against a locked baseline every two hours.
Encrypted, and deleted when it is no longer needed
Encrypted in transit and at rest
Every connection uses HTTPS, and browsers are told to only ever use HTTPS. Stored data is encrypted at rest by our hosting provider.
Device passcodes
Passcodes and account logins a customer gives for a repair are held in a separate encrypted vault. The key never sits in the database, staff cannot browse the vault, and the passcode is deleted automatically once the job is finished. Revealing one needs the owner’s one-time code, and every access is logged.
Old data deleted on schedule
Inactive leads after 24 months, resolved support conversations 24 months after they close, and call recordings after 12 months.
Who can see what
Personal logins, switched off instantly
Staff sign in with their own login. Switch someone off and their access ends everywhere, immediately.
Permissions checked by the database
Roles and per-person permissions are checked on every sensitive action, not just hidden in a menu.
An audit trail
Price, stock and team changes are logged with who made them, what changed and when. Staff cannot edit these logs.
PINs never stored
Counter PINs are kept only as a strong one-way hash. Five wrong tries locks a PIN for 15 minutes.
We never see card numbers or ID documents
Card payments
Card payments go through PCI DSS Level 1 providers: Stripe, Square and Tyro. Tilow records only that a payment happened.
ID checks without holding ID
Sellers verify with Stripe Identity, using a document and a selfie. Stripe keeps the document; Tilow keeps only the result.
Privacy and consent, built in
Real opt-out
One-click unsubscribe on email and STOP on SMS, honoured automatically at the moment of sending.
Consent on record
Every consent change is recorded: who, when and how. Customers choose which kinds of messages they get, and can go on a do-not-contact or do-not-call list.
Minimal tracking
Email tracking records only that a message was opened or a link clicked, never the reader’s IP address or device.
Your data, on request
Customers can ask for a copy of their data, a correction or deletion, and the business handles it inside Tilow with a record of each request.
Breach register
A standing data-breach register, with the notification clock built in.
AI with guardrails
One conversation at a time
AI runs on our servers and sees one customer’s conversation at a time, never another customer’s. A person reviews AI-drafted replies before they are sent.
Not used for training
Our AI provider does not train on this data, under its commercial terms.
Reversible and reviewed
When our phone assistant changes a booking, the change can be reversed and is flagged for a staff member to review. It does not take payments.
How we build
Reviewed and tested
Every change goes through review and automated checks, and runs on a separate staging system before it reaches the live one.
Kept up to date
Dependencies are checked for updates every week.
Browser protections
Tilow cannot be embedded in other sites, and camera and microphone access is limited to Tilow itself.
Where Tilow runs
Tilow runs on Supabase and Amazon Web Services, whose infrastructure is independently audited. Payment, messaging and accounting services are connected only when a business chooses to turn them on.
Found something?
If you believe you have found a security problem, or a way to see data you should not, tell us in confidence through our contact form and choose "Security". We will acknowledge it and work with you in good faith.