Security

How we protect your data

Consultainer holds sensitive client and billing data for engineering consultancies, so we treat security as part of the product, not an afterthought. Here's what that means concretely.

Encryption everywhere

All traffic to Consultainer is served over HTTPS. Your database is encrypted at rest, and OAuth tokens for connected integrations (QuickBooks, GitHub, Linear) are encrypted at rest separately from the data they access.

Account security options

Passwords are salted and hashed, never stored in plain text. You can additionally require a passkey, TOTP two-factor authentication, or your organization's own SSO provider (OIDC) for sign-in.

Tenant isolation

Every record in Consultainer — clients, projects, time entries, invoices — is scoped to your organization at the database layer. Application code enforces that scope on every query; there's no cross-organization query path.

Infrastructure

Consultainer runs on AWS, with a dedicated Postgres database (not shared infrastructure with any other Armistice Group product), automated encrypted backups, and secrets held in AWS Secrets Manager rather than in application config.

Backups & availability

Our production database takes automated daily backups with point-in-time recovery. We're a small, focused team running a single-region deployment today — if your organization requires multi-region failover guarantees as a condition of purchase, tell us and we'll talk through it directly.

Vendors we rely on

AWS for hosting and infrastructure, Stripe for payment processing (we never see full card numbers), Resend for transactional email, and Rybbit for privacy-focused aggregate analytics. Integrations with QuickBooks, GitHub, and Linear are opt-in and only activate when you connect them. See our Privacy Policy for the full data-handling picture.

Certifications

We don't currently hold formal certifications like SOC 2 or ISO 27001. If you're evaluating Consultainer as part of a vendor security review, email us — we're glad to walk through our architecture directly or fill out a questionnaire.

Reporting a vulnerability

Found a security issue? Email support@consultainer.app with details — we'll respond promptly and credit responsible disclosure.