Security
Your records stay yours, and every change is on the log.
This page sets out the security controls that exist in MaintenanceIQ today, from tenant isolation and access control to the audit log and private file storage. It helps your IT team and your compliance head check the facts before a pilot, including what we do not offer yet.
Controls that exist today
Tenant isolation at the backend
One platform serves every customer organization, with strict isolation between them. The database is locked so that only the backend can reach it, and the backend is the real boundary. Access is checked there on every action, including reads, not just hidden in the interface.
Data governance
People can see and change only the data they are allowed to. Who can reach which records is controlled, so access stays deliberate rather than accidental.
Request validation
Every request is validated against a schema (Zod), and fields a client should not set are stripped before anything is written.
Audit log on every write
Every write is recorded: who changed what, and when. Deleted work orders are hidden from work views but kept in the audit log and the evidence pack, with a mandatory reason.
Private storage and signed links
Photos, documents, certificates and evidence packs live in private storage. They are served through short-lived signed URLs, never public links.
Role x feature x action permissions
Admins set what each role can do, feature by feature and action by action, and can grant or revoke specific permissions for one person on top of their role.
Factory and department scoping
Members are scoped to one or more factories, and optionally to their departments, so a technician sees only the work they are assigned to.
Read-only support access
When our support team needs to see what you see, they use read-only impersonation. They can look, but they cannot change your records.
Single sign-on
People sign in with the company identity your IT already runs. Role, factory and department permissions still decide what each person can see. See single sign-on.
API access
A token-authenticated API lets other systems read and write work orders, assets, breakdowns and machine readings inside your organization. See API access.
Records that cannot be quietly rewritten
Evidence packs are frozen as records when they are generated and cannot be edited afterwards. A pack can carry an optional electronic signature that binds the named signer, a timestamp and the meaning of the signature.
Completed checklist runs are frozen. Shell weight verdicts store the band they were judged against. In the EHS module, rates such as LTIFR and TRIR are worked out each time you view them, so a corrected entry can never disagree with its own total.
When a trial ends, the workspace becomes read-only and the data is kept. When a licensed module is switched off, it is hidden and its records are kept.
This website
This marketing website is fast, static and secure. We use Google Analytics and Microsoft Clarity only if you agree to cookies: nothing loads until you click Accept, and you can change your choice any time from "Cookie settings" in the footer. The site sets a strict content security policy and referrer policy. See the privacy notice for details.
Frequently asked questions
Where is the boundary between tenants enforced?
In the backend. The database is locked so only the backend can reach it, the backend checks access on every action including reads, and data governance means people can see and change only the data they are allowed to.
Does MaintenanceIQ support single sign-on?
Yes. People sign in with the company identity your IT already runs. Admins still set each member's role, factories and departments. See the single sign-on page.
Is there an API?
Yes. A token-authenticated API lets other systems read and write work orders, assets, breakdowns and machine readings inside your organization. See API access.
Do you have a SOC 2 report?
No. We do not hold a SOC 2 report or an ISO 27001 certificate today. We can walk your IT team through the controls on this page.
Can your support team change our data?
No. Support uses read-only impersonation, so they can see what you see but cannot change it.
How are photos and documents protected?
They are kept in private storage and served through short-lived signed URLs. There are no public links to your files.
Keep reading
Single sign-on
Company login, with the same role and factory rules after it.
ReadAPI access
A token for other systems that need the same records.
ReadCompliance evidence packs
How packs are built, frozen and signed.
Read21 CFR Part 11 and electronic signatures
Signer, timestamp and meaning, explained.
ReadCompany and contact
Who builds MaintenanceIQ, and how to reach us.
Read