Security Overview

1. Overview

Better Cards secures ComfortOS using defense-in-depth controls appropriate for business data belonging to HVAC contractors and their customers.

2. Security Controls

Key controls include:

• Multi-tenant isolation with tenant_id scoping and PostgreSQL row-level security on tenant tables.
• JWT access tokens with refresh rotation and role-based authorization.
• Encryption in transit (TLS 1.2+) for web and API traffic.
• Encrypted storage for database and object storage at rest via cloud provider defaults.
• Secrets stored in environment configuration, not in source code.
• Background job queues isolated per deployment with retry and dead-letter handling.
• Audit logging for sensitive administrative actions.

3. Payments and PCI

ComfortOS does not store raw card numbers. Payment card data is tokenized by integrated payment processors. Merchants remain responsible for PCI compliance in their own businesses.

4. Vulnerability Reporting

Report security issues responsibly through the contact form at https://getcomfortos.com/home/contact. Do not access other tenants' data when testing. We acknowledge valid reports and work to remediate confirmed vulnerabilities.