Security

The short version

• Every record is scoped to one workspace at the data layer. A query cannot reach another company’s rows, because the scope is applied where the query is built rather than where it is called.
• No passwords are stored. Sign-in is through Google or Microsoft only.
• No uploads, no third-party scripts, no card data. There is nothing to scan, nothing to track with, and nothing to breach.

Where it runs

The application runs on Render and the database on MongoDB Atlas, both in the Singapore region. Traffic is encrypted in transit with TLS. Data at rest is encrypted by the hosting providers as standard.

Who can reach a workspace

Two roles. An admin can add and change records, import, run a stocktake and change settings. A member can see everything and export it, and can change nothing; every route that writes refuses a member on the server, not only on the screen. One account is the owner: it cannot be removed or demoted, and it alone can delete the workspace or hand it to somebody else.

Sessions are signed tokens in an HTTP-only cookie. Requests that change data are checked against the site’s own origin, so a page elsewhere cannot make a signed-in browser act on its behalf.

Equipment links sent to staff

An employee who receives an equipment link signs in to nothing. The link carries a token of 32 random bytes; only a hash of it is stored, it expires after 30 days, and sending a new one replaces the old. The page it opens shows that person’s own equipment and nothing else: no costs, no other people, no locations.

Labels and the public card

A scanned QR label opens a card that shows the company name, the asset tag and the contact address the workspace has chosen. It never shows the asset’s name, serial, holder, value or location. Scans from a single connection are rate limited.

Payments

Payment is taken by Dodo Payments as Merchant of Record. Card details go to them and never pass through CATCH20Two. Every message Dodo sends back is verified against a signature before it changes anything, and each one is applied at most once.

Email

Email leaves through Resend. Every message about a workspace carries a reply address at that company. Unsubscribe links act only on a confirmed click, so a corporate link scanner cannot switch a colleague’s emails off.

What is never stored

• Passwords. Sign-in is delegated to Google or Microsoft.
• Card numbers or bank details.
• Files. The product accepts no uploads of any kind.
• Analytics or tracking data. No third-party script runs on any page.

Backups and export

The database is exported nightly and each export is kept for ninety days. Independently of that, every asset, person and event exports to CSV from inside the product at any time, including after a trial ends. Export is a right, not a feature.

Reporting a problem

Write to hello@catch20two.com. A report about a security fault is answered first, before anything else in the inbox.

What this page does not claim

There is no SOC 2 report, no ISO certification and no penetration test to cite. A data processing agreement is available on request. As each of those changes, this page changes with it.