Last updated: July 1, 2026

1. Infrastructure

Bore-ON.com is hosted on Google Cloud Platform via Firebase. All data is stored in US-based data centers with 99.9% uptime SLA. Our infrastructure benefits from Google's enterprise-grade physical security, network protection, and operational practices.

2. Data Encryption

All data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption. Database backups are encrypted and stored in Google Cloud Storage.

3. Authentication

We use Firebase Authentication with support for email/password and Google OAuth. All passwords are hashed using industry-standard algorithms. Role-based access control restricts data access to authorized users only.

4. Access Control

Bore-ON.com implements role-based access control. Employee roles are Super Admin, Admin, Supervisor, Foreman, Assistant Foreman, Crew Lead, Locator, Mechanic and Crew; limited external roles (Contractor, Drops Access and Customer) reach only the screens their work requires. Each role has specific permissions that limit access to relevant features and data, enforced in the database itself rather than only in the interface. Multi-company isolation keeps each organization's data separate.

5. Audit Trail

Actions taken through the application are recorded with a timestamp, the acting user, the record affected, and the values before and after the change. Entries cannot be edited or deleted once written — the database refuses both. Credentials and similar sensitive values are masked before an entry is stored.

Audit entries are retained for 365 days and then removed automatically. Other operational records have their own retention — GPS trip history 180 days, alerts and notifications 90 days, voice-session records 30 days.

Every entry names the signed-in person who made the change; the system refuses entries that claim otherwise. Recorded today: every save, edit and delete made through the app's standard paths, every change to an 811 ticket (status, merges, response refreshes, imports), production ledger approvals, invoicing and reopens, subscription changes applied by Stripe, deletions of drops, products and card statements, and fiber field-log records. Some automated background writes (nightly ledger generation, GPS telemetry) are not individually recorded. If you need an audit record of a specific activity for a compliance or insurance requirement, ask us and we will tell you plainly whether it is covered today.

6. Data Backup

The database is exported automatically every night and retained for 30 days, and each company's records are additionally snapshotted weekly. Restoring from a nightly export can lose changes made since that export ran; we do not currently offer continuous point-in-time recovery.

Photos, PDFs and other uploaded files are not part of those database exports. They are held in Google Cloud Storage, which replicates them across a region, and the application never bulk-deletes them.

7. Reporting Vulnerabilities

If you discover a security vulnerability, please report it to admin@bore-on.com. We take all reports seriously and will respond promptly.