Your data is yours, and your systems can talk.
Who sees what, what gets recorded, how the product connects to the outside. Plainly, as it is.
Security and permissions
- Per-company data separation
- Company identity is read only from the signed session token, never from a request body. Queries across all modules are filtered by company, and records are stamped with it.
- Roles and permissions
- 9 role templates for super admin, admin, operations, technician, warehouse, finance, dealer, sub-service and customer, with a permission matrix and personal extra permissions.
- Record scope
- All records, selected regions, selected customers, jobs assigned to me, a sub-service’s own jobs. Reports and suggestions follow the scope too. Permissions are enforced on the server.
- Passwords and sessions
- Passwords are stored with Argon2id and never shown anywhere. Optional two-step verification with recovery codes on the web. Users see and close their own sessions.
- Audit records
- Job history is append-only: user, time, channel. Device and masked IP need a separate permission. Rule changes and field changes on tracked records are logged too.
- Corrections, not deletions
- Stock documents and ledger rows are not edited, they are corrected by reversal. A closed work order cannot be changed.
- Rate limits
- Per user, per IP on public endpoints and per API key.
- Secrets and files
- SMTP and SMS account details are encrypted at field level. Files sit in storage keyed to your company and open through short-lived signed links.
Personal data
The product keeps versioned terms of use, a KVKK privacy notice and a commercial message consent text, and records acceptance with version and hash. It is built to reduce exposure:
- The last block of an IP address is masked.
- The customer portal hides costs, internal notes and priority.
- The website lookup returns no name, address or amount.
- Survey and approval links are stored hashed and masked in the delivery log.
- Reports exclude contact details.
- The interface loads fonts locally, so no IP goes to a third party.
Integrations
The product works fully on its own: customer accounts, stock, payments and settlement live inside it. It talks to your other systems through a REST API and webhooks. There is no ready-made ERP connector.
- REST API and keys
- Keys independent of users, with chosen permissions, expiry and revocation. A key is shown once and stored hashed, and every call is logged. 120 requests per minute by default.
- Webhooks
- 11 events such as work order opened, status changed, assigned, SLA breached, payment, service request, maintenance due and minimum stock. HTTPS, HMAC-SHA256 signature, 8 tries over 24 hours, delivery log.
- API document
- An OpenAPI document for permitted users, listing only endpoints callable with a key.
- Website boxes
- Two boxes embedded on your company site: record lookup and service request, with a site key and a list of allowed sites.
- Notification channels
- SMS, e-mail and mobile notification rules, plus an in-app inbox. E-mail goes from your SMTP account and SMS from your own account.
- Excel
- Export from lists, and import with dry run and undo for products, customers, devices, staff, opening stock and past work orders.
Documents it produces
- Priced service form
- Unpriced service form
- Damage-repair form
- Installation form
- Quote
- Checklist
- Material cost form
- Shipping label
- Barcode label
Have technical questions?
Bring your IT team. We will talk through integration and permissions on your own scenario.