ShopFloor Quality Tracker

Security

This page summarizes how ShopFloor Quality Tracker is built and operated. It is a description of current practice, not a certification or a service-level agreement.

1. Hosting and sign-in

ShopFloor is a web app at https://shopfloor-action-compass.lovable.app, built and hosted on Lovable. Sign-in is email and password. New accounts need at least 8 characters and an email confirmation. Password reset works through an emailed link. Single sign-on (SSO) is not offered yet. Two-factor sign-in (MFA) is available: users can turn it on with an authenticator app. It is optional and is not required to sign in.

2. How company data is kept separate

All companies share one database, and every record carries a company ID. Database-level row security is used so a signed-in user can read only their own company's rows, and visitors who are not signed in can access nothing. The Owner can export the company's data from Settings.

3. Encryption in transit

Data is sent over encrypted HTTPS connections.

4. Hosting, region and backups

The app is hosted by Lovable, with web traffic passing through Cloudflare. ShopFloor's database is in the Americas, in AWS US East (Ohio). Lovable backs up the database once a day and keeps about 14 days of backups. Restores go back to a daily snapshot; there is no point-in-time recovery. Uploaded files are not included in those backups. For now, Lovable's daily backups are the only backups.

5. Availability

ShopFloor does not offer an uptime service-level agreement (SLA). The Terms of Service do not promise the Service will be uninterrupted or error-free.

6. If the service is discontinued

If ShopFloor is discontinued, Owners will receive at least 60 days' written notice by email, and can export their company's data during that period. This is in the published Terms of Service, section 11, effective November 11, 2026.

7. File uploads

Uploads are images and PDFs only, with a 10 MB maximum each, stored privately per company. Uploads are checked for type and size only. ShopFloor does not scan uploads for malware today. Malware scanning is on the roadmap and is not live.

8. Independent testing and certifications

An independent penetration test of ShopFloor has not been done yet; one is planned within the next 12 months. ShopFloor, as a small product run by one person, has no certification or third-party audit of its own. Lovable states that its platform holds SOC 2 Type II and ISO 27001:2022. Those certifications cover Lovable's platform, not ShopFloor itself.

9. Contact

For security concerns and urgent issues, email gotschalljake@gmail.com.