Security

Lawn Care Manager is designed for a single landscaping business operating with role-based staff access.

Controls

Owner, manager, and field role policies are enforced server-side.
Customer portal links use hashed, expiring, one-time tokens.
Stripe webhooks and Twilio SMS webhooks are signature-validated.
Cron routes require bearer-secret authorization in production.
Uploads are limited to supported image files under 8 MB.

Operational requirements

Production deployments must use managed Postgres, strong secrets, configured monitoring, backups, and provider-side Stripe, Twilio, Resend, and storage controls.