Your customer list is yours.

Isolation is enforced by the database, not by our code

Most software keeps businesses apart in application code: every query is supposed to include "…and only this customer's rows". It works right up until one query forgets, and then one business sees another's data.

ToolHut does it a layer lower. Every table has row-level security switched on inside PostgreSQL itself, with a policy tying each row to the business that owns it. If our application code forgets the filter, the database still refuses. The check does not depend on us getting every query right.

And a new table cannot ship without it

That has to stay true for the next table someone adds, too. So the database enforces the rule itself: whenever a table is created, row-level security is switched on automatically. Nobody has to remember.

What the 87 are

• 67 carry per-business policies — your contacts, jobs, quotes, invoices, photos, crew, compliance documents, your org chart and the rest. A signed-in user reaches their own business's rows and nothing else — and where the Hut's tools let you add or edit records, the database itself confines every write to your business.
• 20 are closed to customers entirely — ToolHut's own books, operational alerts and the marketing suppression list. These have security on and no customer policy at all, which means no customer account can read them under any circumstances.

We test it, rather than assume it

A rule like this can look right and still not do anything, and that kind of mistake stays invisible until the day it matters. So we test it: the test creates two real businesses with two real signed-in users, puts data in each, and checks that

• each user can see their own record
• each user cannot see the other's — the row simply is not there
• a signed-out visitor sees nothing at all
• a signed-in user CAN add and edit records with the Hut's own tools — and every such write lands only in their own business, enforced by the database
• a signed-in user cannot write a row into another business

The last two matter as much as the first three — being able to read someone else's records and being able to write into them are different holes, and both are closed. The test runs against the real database as ordinary signed-in users rather than as an administrator, and it clears up after itself.

One honest limit, because it is the kind of thing this page should say out loud: that test covers the database tables your records live in. A database view — a saved query that reads from those tables — does not inherit that protection automatically in PostgreSQL; each one has to be restricted deliberately when it is created.

How you sign in

Two ways, and you pick: a password you set, or a one-time link we email you. The link works once and expires in an hour, so if you would rather not keep a password at all, you do not have to.

Either way, ToolHut never holds your password. Supabase, our sign-in provider, keeps it as a salted hash — never in plain text, and never anywhere we can read it. We cannot tell you what your password is, because we do not know it.

Crew logins work the same way. A crew member you invite sets their own password, because a shared jobsite phone can't always receive email. A crew login can see the day's jobs and the crew's own messages; it can never reach your money, your customers, or your records.

What we do not do

• No analytics product. No Google Analytics, no Meta pixel, no Segment, Mixpanel, Amplitude, PostHog, Hotjar or anything of that kind. Nothing on this site reports your browsing to anybody but us, and the one thing we count ourselves is spelled out below.
• No advertising tag, and nothing that follows you anywhere else on the internet.
• No cookies. Not one, including no "essential" cookie banner to click past — measured on the home page, the signup page and the customer hub.
• We do not sell your data, or your customers' data, to anybody. It is not a revenue line and never will be.
• We do not use your business's data to train AI models.

What we do store in your browser

Three things, and this is the complete list:

• How you first arrived — the referring site, and campaign tags if you clicked an ad or a link we published. This sits in your own browser's local storage on our domain, is captured once on your first visit, and is attached to your signup if you create an account, so we can tell which of our own efforts actually reach people. It is first-party, never shared, and goes no further than our own signup form.
• Your sign-in session, once you are logged in, so you are not asked to sign in on every page.
• A marker, if you arrived from an email we sent your business — one short note per page saying we already counted this visit, so the same click is not counted twice. It holds nothing about you.

That is the whole list. Clearing your browser storage clears all three.

The one thing we count on our side

If ToolHut wrote to your business and you got here by clicking the link in that email, we record on our own server that the link was opened: an internal reference number for your business, which page opened, and when. That is the whole row — no name, no email address, no IP address, and nothing out of the browser storage above, which still never leaves your browser. It is how we tell whether our own letters are worth sending, and nothing else on this site is counted anywhere. The full description is in the Privacy Policy.

Who else sees anything

A page cannot load without the browser contacting whoever serves its pieces, and those companies see the request. Here is every one of them and what they get. There are no others.

Who	What they receive	Why
Supabase	Your account data and your business's records	They host the database and sign-in. This is where your data lives.
Google Fonts	Your IP address and browser, when a page loads	Serves the typefaces. No account data reaches them.
jsDelivr	Your IP address and browser, when a page loads	Serves the database client library. No account data reaches them.
Cloudflare	Your IP address and browser, on the pages where you sign in, sign up, or set a password	Runs the check that tells a person apart from a bot, so nobody can hammer your account with guessed passwords. No account data reaches them, and it runs nowhere else on the site.
Stripe	Your card details, if and when you subscribe	Handles payment. ToolHut never sees or stores your card number.
Twilio	Your business's registration details (legal name, EIN, address, phone) and the text messages your customers send and receive — only if you use a texting package	Carries text messages. US carriers require a business to register before it can text, and that registration is filed with Twilio.
Google Maps	A job's address — only if you tap it	Job addresses on the crew and project pages are links that open in Maps. Nothing is sent unless you tap one.

Getting your data out, and getting it deleted

Both are built into the database and we run them on request. Here is what each one does.

• Export. One request returns every category — every kind of record we hold about your business, as a machine-readable file. Contacts, jobs, quotes, invoices and their line items, photos, calls and their transcripts, crew and timesheets, compliance documents, bookings, change orders, service plans, renewals, referrals, reviews, your branding, your billing history and the account itself. That list is read out of the database rather than typed by hand, so a new kind of record is in your export the day it exists. The single thing held back is our own internal notes about the business — those are about us, not about you.
• Deletion. Asking to be deleted deactivates your business immediately — the software stops, the account is marked closed, and nothing further runs. Your records are then permanently deleted after 30 days by a scheduled job, along with your login. The 30 days are there in case you change your mind. If you would rather not wait, tell us and we will erase everything the same day.

The five things we keep, and why

Five records stay behind. Each one is there for a reason that protects you as much as us, and they hold your business identifier and little else about you:

• Our own income records — what you paid us. Tax law does not stop applying because a customer left.
• Payment disputes, where any exist. If a payment is ever disputed, this is the record that settles it.
• Proof you accepted the Terms — the record that an agreement existed, not its contents.
• The deletion request itself — our record that you asked, and that we carried it out.
• Our internal decision log, which is about us rather than about you.

Everything else goes: contacts, jobs, quotes, invoices, photos, calls and their transcripts, crew records, compliance documents, bookings, your settings, and the account you sign in with.

Both of those are functions in the database that we run on request, not a promise somebody has to remember to keep. See the Privacy Policy for retention periods and the legal detail, and the Terms of Service for the contractual side.

What we cannot claim yet

So that nothing above reads as more than it is:

• No SOC 2 or ISO 27001 certification. We are a new and small company and have not been through either audit.
• No independent penetration test yet. The isolation test above is a real test against the real database, but we wrote it. Nobody outside ToolHut has tried to break in on our behalf.
• No formal uptime commitment. We publish what is running and what has broken on Status, and the first uptime figure will cover a full month with real customers on it.

Found a problem?

Email office@toolhutworks.com with what you found and how to reproduce it. A person will read it, usually the one who wrote the code. We will confirm what you found, fix it, and let you know when it is done.

The numbers on this page were measured against the live database on August 10, 2026. When they change, this page changes.