Security & Trust
Your operations data is the heart of your business. Here is exactly how Rex AI protects it — in plain language, not legalese.
Encryption
All traffic between your browser, the Rex AI application, and our API is encrypted with TLS. Data at rest is stored in managed databases with provider-level encryption, and passwords are hashed with bcrypt — never stored or logged in plain text.
Authentication
Staff sign in with short-lived, signed JWT sessions that expire automatically. Customer portal access uses separate, revocable session tokens — a portal credential can never reach staff surfaces, and vice versa. Active sessions are visible and revocable by the user.
Role-based access control
Seven built-in roles — from owner to viewer — govern every endpoint. Permissions are enforced server-side on each request, not just hidden in the UI, so a technician account can never read billing data or change organization settings.
Organization isolation
Rex AI is multi-tenant with strict row-level scoping: every query is filtered by organization, and portal queries are additionally scoped to the signed-in customer. Isolation is enforced in the API layer and covered by a dedicated automated test suite that runs on every change.
AI privacy
AI features operate on your organization’s data only, and results are never shared across tenants. Your data is not used to train foundation models. When no AI provider is configured, features degrade gracefully — no data leaves the platform.
Data retention & portability
Your data belongs to you. Export customers, assets, work orders, and reports at any time. If you cancel, we retain your data for 90 days for reactivation, then delete it. Enterprise plans can define custom retention windows.
Engineering practices
- Automated test suite (1,500+ backend and frontend tests) runs on every change via CI
- Full audit log of user and administrative actions within each organization
- Production configuration guards — the platform refuses to start with development credentials
- Least-privilege defaults: new users receive the most restricted role until promoted
- Session revocation for both staff and customer portal users
Security roadmap
We publish our roadmap so you know what to expect — and what not to assume.
Questions about security?
Review our Privacy Policy and Terms of Service, check live system status, or talk to our team about your compliance requirements.
Contact Us