Workspace isolation
Every business has its own company record. Customers, jobs, invoices and media are scoped to that company. Staff only see what their role allows.
Security
Your data stays yours
Extero is built for multi-tenant businesses. Each company sits in its own workspace. We do not sell data, and we never sit between you and your customers' money.
Authentication
Accounts use email and password with bot checks on sign-up. Session tokens travel over HTTPS. Password reset links expire.
Encrypted in transit
Traffic to extero.app, app.extero.app, portal.extero.app and the API uses TLS. We do not run advertising trackers on the marketing site.
Payments stay with you
Stripe Connect and GoCardless run under your own accounts. Card and Direct Debit money pays out to your bank on their schedule — Extero never holds customer funds.
Media storage
Job photos live in private object storage with plan-based quotas. Deletes remove the file and free the quota.
Export and leave
Customers, jobs and invoices export to CSV. Leaving is a download, not a support ticket. Your business data remains yours.
What we do not claim
We are a growing product in private beta. We do not currently publish SOC 2, ISO 27001 or similar certification badges. If a buyer needs a formal questionnaire, email [email protected] and we will answer honestly.
Responsible disclosure
If you find a security issue, email [email protected] with steps to reproduce. Please give us a reasonable window before public disclosure so we can fix it.