Security & Trust

Renvori uses layered controls intended to protect GarageOS and enabled Renvori services. Security is a shared responsibility between Renvori, each Customer, and each authorized user.

Core measures

• Authentication and MFA: sensitive administrative and commercial workflows may require multi-factor verification.
• Role-based access: users receive permissions based on their role and workspace membership.
• Tenant isolation: application and database controls are designed to prevent one garage from accessing another garage's records.
• Trusted service boundaries: privileged service credentials are restricted to server-side trusted functions and are not intended for ordinary client-side use.
• Billing separation: Stripe handles payment-card information used for subscriptions; GarageOS stores billing/customer identifiers and subscription status rather than raw card details.
• Audit and integrity controls: important administrative, accounting, payroll, and security workflows may produce audit records and use fail-closed validation.
• Data minimization: users are instructed not to put highly sensitive data in general-purpose locations.
• Incident response: suspected incidents are assessed, contained, documented, and escalated for legal notification where required.

Report a security concern

Report suspected account compromise, phishing, unauthorized access, or other security concerns to security@renvori.ca. Do not include passwords, MFA secrets, SINs, or full payment-card or bank-account numbers in the initial message.

Customer responsibilities

Use unique accounts, enable required MFA, protect recovery methods, keep devices reasonably secure, review user access, remove former staff promptly, avoid credential sharing, keep browsers and operating systems supported, and notify Renvori promptly of suspected compromise.

No absolute-security representation

Security controls reduce risk but cannot eliminate every threat. This page describes Renvori's approach; it is not a guarantee that an incident can never occur and not a certification under a security standard unless Renvori expressly states that a specific certification has been obtained.