Security

All traffic to and from MechOS is encrypted with TLS (HTTPS), enforced by HSTS so browsers refuse to connect any other way. Data is encrypted at rest in our managed, industry-standard database.

MechOS is built by an Australian company, MechOS Pty Ltd (ABN 80 698 552 706), for Australian workshops.

Your workshop data sits in managed cloud infrastructure, encrypted at rest and in transit, with daily backups on a rolling seven-day window and separate off-site copies taken every six hours. Every tenant is isolated at the database, not just in the application. The Trust page names the exact regions and every subprocessor we use.

• Per-tenant isolation at the database. Every workshop’s data is walled off by row-level security in the database itself — not just in application code — and that isolation is covered by an automated test suite that runs on every change.
• Role-based access. Owners, admins, service advisors, contractors and technicians each see only what their role allows; sensitive money and settings screens are gated at the database.
• Authenticated access with a minimum 10-character password policy. Successful logins are recorded to an audit trail.
• Two-factor authentication (2FA). Users can add a second sign-in step with an authenticator app. Once someone has set it up, it’s enforced at the database — not just the login screen — so their password alone can’t reach the workshop’s data.

Every response ships strict security headers, verifiable in your browser:

• HTTP Strict Transport Security (HSTS)
• X-Frame-Options: DENY and frame-ancestors ‘none’ — MechOS cannot be embedded/clickjacked
• X-Content-Type-Options: nosniff
• Referrer-Policy and a restrictive Permissions-Policy
• A Content Security Policy (currently in report-only monitoring while we validate it, ahead of enforcement)

Authentication and other sensitive endpoints are rate-limited to blunt abuse and brute-force attempts.

Errors and anomalies are captured in real time by our monitoring stack, and priority incidents page our on-call responder immediately so problems are caught before you feel them — not reported by you after the fact.

• Automated daily backups on a rolling 7-day window.
• Separate, encrypted off-site copies taken every six hours, with a different provider in a different account — so one failure cannot take both.
• We test our restores. Backups you have never restored are just hope — we run periodic restore drills against real backups and keep a documented recovery procedure.

Account and administrative activity — including logins and platform-admin actions — is written to a durable audit trail, so there is an accountable record of who did what and when.

• Dependency vulnerability scanning and automated dependency updates.
• Automated secret scanning so credentials never reach the codebase.
• Type-checked, gated builds — code that fails our checks does not ship.

MechOS runs on a global edge platform (Vercel) that provides automatic TLS and network-level DDoS mitigation, on top of a managed Postgres database with daily backups.

Card payments are handled by PCI-DSS-compliant payment providers. MechOS never sees or stores your customers’ full card numbers.

If you believe you have found a security issue, please tell us at security@getmechos.com.au before disclosing it publicly. We will investigate promptly, keep you updated, and we will not pursue action against good-faith researchers who report responsibly and avoid privacy violations or service disruption.

We are a young company and we would rather be honest about what is not built yet than imply otherwise. Coming next:

• Single sign-on (SSO) for larger teams.
• A formal, independent security assessment as we scale.

Security

security@getmechos.com.au

See also our Trust and Privacy Policy pages.