Data protection & security

Last updated October 6, 2026

Businesses trust LAPS Supply CRM with their customers' names, phone numbers and addresses. This page describes how we protect that information and what we do if something goes wrong.

How data is kept apart

  • Every company has its own database. One company's pages can't read another company's records.
  • Passwords, tokens and connection keys are stored outside the website's files and are readable only by the application.
  • Test and development data is kept separate from live data.

Access

  • Sign-in uses one-time emailed links that expire after 15 minutes. There are no passwords to reuse or leak.
  • Users have a role — owner, office or technician — and technicians only see their own day.
  • Access can be removed at once: a user can be disabled and signed out of every device. Email us and we'll do it right away.
  • Only LAPS Supply administrators can reach the servers, using SSH keys. Any time we open a customer's account for support, it is logged.

In transit and at rest

  • All traffic is encrypted with HTTPS.
  • Databases are backed up every night to Google Cloud Storage, which encrypts stored data. Job photos are backed up nightly too.
  • Uploaded photos are re-saved without hidden location data.

Preventing data loss and leaks

  • The application's database login can only read and change rows. It can't drop tables or export whole databases.
  • Live customer data is never copied to laptops or used for testing; development uses made-up data.
  • Photos and files are stored outside the website and only served to signed-in users of the same company, or through a customer photo link that can be switched off.
  • Nightly off-site backups mean nothing is lost if a server fails.

Logging and monitoring

  • Changes to bookings, billing and settings are recorded in an audit log with who made them and when.
  • Sign-ins and administrative actions are logged, and each request to the app is logged with the signed-in user.
  • Automated checks run nightly to confirm records are consistent.

Incident response

  1. Contain: as soon as we suspect a security incident, we limit the damage — for example by revoking keys, signing users out or taking a component offline.
  2. Investigate: we work out what happened, what data was involved and which businesses are affected, using our logs.
  3. Notify: we tell affected businesses without undue delay, with what we know and what they should do. Where an incident creates a real risk of significant harm, we report it to the Privacy Commissioner of Canada and help notify affected individuals, as the law requires. For Shopify-connected stores, we also notify Shopify as its terms require.
  4. Fix and learn: we fix the cause, check the fix, and keep a record of the incident and the steps taken.

Shopify data requests

When Shopify sends a request to view or delete a shopper's data, or to delete a store's data after it uninstalls, we act on it within 30 days.

Report a problem

If you think you've found a security issue, email [email protected]. We'll acknowledge it within two business days.