Clear boundaries.A record you can follow.

Security for the operation behind your equipment

Your equipment register also holds customer relationships, commercial terms, inspection evidence and the record of work completed in the field. Protecting that information means controlling who can act, preserving the history and preparing for the day something needs to be recovered.

Hafrix brings these controls into the working product. This page distinguishes the safeguards implemented in the application from the operational and contractual requirements we review with each customer.

Your workspace stays separate

Customer records are scoped to a workspace. Hafrix checks the signed-in person's active membership and applies workspace restrictions in the application and database. Database row-level security provides another boundary around customer records, and automated tests exercise attempts to read across workspaces.

The separate Hafrix staff console uses its own access scope. A staff-console session is not a customer-workspace session and does not automatically grant access to the customer's operational screens. Customer administration and service administration remain distinct responsibilities.

Give people the access their work needs

Roles determine what a person can change. Groups determine which application sections they can open. A warehouse operator, field engineer and finance colleague can work in the same operation with different access to its records. These checks apply to server requests as well as visible controls.

Account controls include authenticator-based two-factor authentication, recovery codes and a list of signed-in devices. Two-factor authentication is required for the Hafrix staff console. Customer-account requirements and enrollment are reviewed during setup; we do not describe every customer account as automatically enrolled.

Revoking a session or workspace membership is checked on the next authenticated server request, rather than waiting for an old access token to expire. Administrators should review access when people join, change responsibility or leave.

Keep documents private

Operational attachments are stored privately and organized by workspace. The application checks the relevant access before issuing a time-limited download link. Inspection reports, ticket attachments and maintenance photographs are not intended to become public files because they were uploaded to Hafrix.

A signed download link can be used by someone who receives it until it expires. Treat the link and any downloaded copy as business information, particularly when sharing documents outside your team.

Protect connections and sensitive credentials

Public browser connections use HTTPS. Passwords are stored as hashes. Authenticator secrets and supported stored mail and backup-provider credentials are encrypted in the application rather than exposed as readable configuration fields.

Encryption has a scope: these controls do not establish that every database volume, object, log or local phone copy is encrypted at rest. Hosting, storage encryption and key-management requirements belong in the deployment review, supported by evidence for the services actually used.

Keep a record of important actions

Equipment history and security events help answer what happened, when and who performed the action. Operational event records are protected against ordinary editing, with corrections represented through the applicable workflow. Account activity records sign-in and security events, while workspace access changes have their own audit context.

Audit coverage and retention should match the customer's review needs. A product history is useful evidence; it is not a claim that every possible action is captured in an independently certified audit system.

Plan recovery around the business

Hafrix includes database backup, object-storage copy and offsite-transfer tooling. Restore checks can rebuild a backup in an isolated environment and check the restored data and access boundaries. Offsite copies support encryption before transfer, and failed backup operations can raise an alert.

The operating runbooks provide for scheduled backups and restore rehearsals. During onboarding, confirm the active schedule, retention, encryption settings and recent restore evidence. Agree the acceptable amount of lost work and the required recovery time before treating them as service commitments. A configured backup is not an uptime guarantee.

Understand the field-device boundary

The mobile app keeps permitted field data on the device so prepared work can continue offline. It excludes finance rates, prices and invoices from that offline data set. Hafrix does not encrypt the local browser database itself: device locks, operating-system protections and sensible sharing rules matter. A disconnected phone cannot receive a remote revocation until it reconnects.

Review the requirements before rollout

Tell us about required hosting countries, data retention, independent testing, incident communication, identity integration and customer security reviews. We will identify what is already supported, what needs configuration and what requires further implementation. We do not claim SOC 2 or ISO 27001 certification, universal data residency, a completed independent penetration test or an incident-response time without the corresponding evidence and agreement.

For a security review, contact Briza Group LLC at info@brizagroup.com. Please describe the affected workflow and a safe way to contact you; do not send passwords or customer-data extracts. Read the privacy notice, DPA and service commitments, or request a security-focused demo.

Reporting a vulnerability

If you believe you have found a security vulnerability in Hafrix, email security@hafrix.com with a subject line starting SECURITY:. If that address bounces, use info@brizagroup.com. Include the affected URL, screen or API endpoint, the steps to reproduce, what an attacker could gain and a safe way to reach you. Do not send passwords, access tokens or extracts of customer data. The same contact is published in machine-readable form at hafrix.com/.well-known/security.txt.

Research safely: test only against your own account or workspace; do not access, change or delete other customers' data; do not run denial-of-service, volumetric or social-engineering tests; and give us reasonable time to fix an issue before disclosing it. We will not pursue legal action against good-faith research that follows these rules. We do not run a paid bug bounty; with your permission, we will credit you once the issue is fixed.

Scope covers the Hafrix application, API and website at *.hafrix.com. Report issues in third-party services we use directly to those providers.