Repairix stores sensitive business data on behalf of repair shops. We take that responsibility seriously. This page explains how we protect your data and the controls we have in place.
Each Repairix workspace is logically isolated using row-level security (RLS) at the database layer. A workspace user cannot query, read, or modify data belonging to any other workspace — this is enforced at the database level, not just application logic.
Administrative access to the Repairix platform is restricted to named EWI Software staff via the Control Centre, using signed session tokens with MFA.
User authentication is provided by Supabase Auth, using industry-standard JWT tokens. Passwords are hashed and never stored in plaintext.
Multi-factor authentication (TOTP via authenticator apps, and email OTP) is active for all non-SSO users. Enterprise customers with SSO can enforce MFA through their own identity provider.
Repairix is a multi-tenant platform. Each workspace operates on its own subdomain (e.g. yourshop.repairix.com.au) and all database queries are scoped to that workspace's identifier. Our RLS policies are tested as part of every deployment.
Database backups are managed by Supabase with point-in-time recovery. Production data is backed up continuously with a minimum 7-day retention window.
If you believe you've found a security vulnerability in Repairix, please report it responsibly to security@repairix.com.au. We'll acknowledge your report within 2 business days and aim to resolve confirmed issues within 30 days.
We're working toward SOC 2 Type 2 attestation — an independent audit by a CPA firm verifying our controls for security, availability, and confidentiality. Enterprise customers who need more information should contact security@repairix.com.au.
For security questions or to request sub-processor DPA agreements, contact security@repairix.com.au.