Security

The short version: every sign in needs more than a password, each company's data is kept apart from every other company's, every change is recorded, and your administrators decide who gets in and what they can do.

Signing in

• Every password sign in asks for a second step: a code sent by email, or a code from an authenticator app.
• Passkeys: sign in with Face ID, Touch ID, Windows Hello or a security key instead of a password.
• Microsoft Entra ID: your team can sign in with their Microsoft work accounts, so your own multifactor and conditional access policies apply. Microsoft can be made the only way in, with break glass recovery for administrators using a passkey.
• New sign in alerts: people are emailed when their account is used from a device it has not seen before.
• Lost devices: administrators can reset a person's authenticator and passkeys, and every session can be signed out at once.

Who can do what

• Roles: Admin, Manager, Technician and Viewer, plus roles your administrators make themselves with the permissions they choose.
• Entra groups and SCIM: Entra groups can decide each person's role, and SCIM provisioning creates and turns off accounts from your directory, so someone who leaves loses access when they leave Entra.
• No single point of failure: any administrator can manage the account, so it never depends on one person.

Your data

• Kept apart: each company's records are separated from every other company's, and automated tests check that one company can never see another's.
• Encrypted connections: everything travels over HTTPS.
• Passwords are stored only as one way hashes.
• No guessable links: records are addressed by random identifiers, never by counting numbers.
• Files: every file is checked against your permissions before it is served, share links can expire or be turned off, and on plans that include it, files can live in your own S3 compatible storage.

What our staff can see

• Accounts, not records: TekStacks staff see each company's name, plan, billing contact and how much it uses, plus usage analytics. They do not see your equipment, employees, documentation, files or network details.
• No signing in as you: staff tools cannot sign in as a person or act as a company.
• Your Microsoft directory stays yours: staff have no access to your Microsoft Entra ID connection. No staff tool can reach your directory, list its users or groups, or see its settings; only the features your administrators turn on use it.

Where your data lives

• Servers in North America: the application, database and files run on servers in North America.
• Offsite backups: backups are kept offsite for full disaster recovery.
• High availability: TekStacks runs on redundant infrastructure so a single failure does not take it down.

A complete history

Every change in your account is recorded with who made it, when, from which IP address, and the old and new values. The history cannot be edited. Equipment keeps a record of every person who held it, and disposal records the method, the date and when the drive was wiped.

Payments

Payments are handled by Stripe. TekStacks never sees or stores card numbers.

Providers

A few providers handle data only to run TekStacks for us:

• Cloudflare, which carries traffic to TekStacks and provides its security certificates.
• Amazon Web Services, which delivers our email and stores uploaded files, in the United States.
• Stripe, which handles payments.
• Microsoft, only for companies that connect Microsoft Entra ID.

When an account closes

Administrators can request a download of their company's records from Settings. When a company closes its account or a trial ends without a plan, its data is deleted after a grace period, with emails before it happens. Backups expire on their own schedule.

Reporting a problem

If you find a security issue, write to [email protected]. We will reply, keep you informed while we fix it, and credit you if you like.