Security Overview

A summary for security and procurement review. For how we collect and handle personal data, see our privacy policy.

Tenant isolation

CampMarshal is multi-tenant: every customer organization's data lives in the same database, separated by Postgres Row Level Security (RLS) rather than by application code alone. Every table that holds customer data carries an organization identifier, and RLS policies filter on it (and on the requesting user's access tier) before a single row is returned — a bug in a page or a server action can't bypass this, because the database enforces it independent of what the app asks for.

Access control

Users hold one of four access tiers (Field Seat, Equipment Lead, Site Manager, Full-Access) plus a small set of explicit special permissions for capabilities like granting a tier upgrade or authorizing a cross-company equipment loan. Promoting someone to a higher tier requires the actor to already hold that specific capability, not just a high enough tier of their own — this is enforced by the database, not only checked in the interface.

Multi-factor authentication

Office accounts use an authenticator-app second factor. Each organization can require it for Site Manager and Full-Access (on unless an admin turns it off). Equipment Lead and Field Seat are not required to enroll. CampMarshal platform-operator accounts must enroll before the operator area opens, including when an organization has turned its own requirement off. Once a factor is on, each new sign-in must enter a code from the app, and the account can turn it off again from Settings. Removing the last factor sends a platform operator back through enrollment the next time they open the operator area. A Site Manager or Full-Access person who uses a privileged action in the mobile app is asked for the same code there. Field work itself does not ask for it.

Audit logging

Privileged actions — invites, access-tier changes, access-key issuance and revocation, special-permission grants and revokes, and platform-level billing edits — are written to an append-only audit log. A Full-Access user can view and export their organization's own audit history; nothing outside an organization's own records is visible to it.

Encryption

Data in transit is encrypted with HTTPS/TLS. The mobile app's offline data queue and session token are encrypted at rest on the device.

Field history integrity

Equipment scans and status-change history are recorded as append-only event logs — existing entries are never edited or deleted, only added to — so a piece of equipment's history can't be silently rewritten after the fact.

What we are not

CampMarshal is not SOC 2 certified, and we don't claim ISO 27001 or any other formal security certification at this time. We also don't currently publish a live status page or a third-party penetration-test report. If a certification, a signed pen-test letter, or a Data Processing Agreement (DPA) is a requirement for your organization, contact us — those are handled directly rather than through this page.

Reporting a vulnerability

If you believe you've found a security issue, please email us at help@campmarshal.com rather than filing a public issue or testing against another customer's data.

Contact

Security or compliance questions: help@campmarshal.com.