Your shop's data, looked after properly.
You trust CoreHub with your takings, your stock and your customers' details. Here is plainly how we keep them safe, and what stays in your hands.
Signing in
A code on every new device
Sign in from a computer, tablet or phone we haven't seen before and we send a 6-digit code by email, or by text if you have added a phone. A stolen password alone isn't enough to get in.
Trusted devices
Once a device has passed the code check it is remembered for 30 days, so your own counter isn't asking every morning.
Verified sign-ups
Every new account confirms its email with a code before it is made, with a text as a back-up. It keeps fake sign-ups and typos out.
Passwords never stored readable
Passwords are hashed, so not even we can read them. Resets go by a one-time link to your email.
Your shop
Everyone signs in as themselves
Each staff member has their own login, so every sale, refund, no-sale and job change is recorded under the person who did it.
Only the owner manages staff
Adding staff, removing them and resetting their passwords is for the owner only, and is checked on every action.
Shops kept apart
Every business only ever sees its own customers, stock, sales and jobs. Each location keeps its own records too.
Demo kept separate
The public demo is its own shop with its own sample data. Nothing you do there touches a real business.
Your customers
Private job photos
Job photos are kept in private storage, not on your public website. A customer only sees the ones you choose to show on their own quote.
Photos that tidy themselves
When a customer declines a quote, the photos on it are deleted automatically 5 days later.
Private quote links
Each quote link is long and random, so it can't be guessed. Accepting, declining and paying are rate-limited to stop abuse.
Reviews you approve
Customer reviews come through a private link and only show on your website once you approve them.
Our systems
Encrypted in transit
Every page and every connection uses HTTPS, for the app, the demo and every CoreHub website.
Cloudflare in front
Traffic passes through Cloudflare for content delivery and protection against attacks.
Hosted in New Zealand
Our servers are in New Zealand, with regular backups and monitoring.
Card details never stored
Card payments are handled by the payment processor. Card numbers never touch our servers.
You own it. You can take it with you.
You and your staff own everything you put into CoreHub: customers, sales, stock and repair records. We only use it to run the service for you.
- Exports on request, any time, including after you cancel
- Kept for at least 30 days after you close your account, so you can change your mind
- Handled under the Privacy Act 2020, as a New Zealand company
- Never sold. We only share what our service providers need to run CoreHub
Your part
Security works best when we both do our bit. A few simple habits go a long way.
- Use a strong password that you don't use anywhere else
- Give each staff member their own login. Don't share one
- Remove a staff member's access the day they leave
- Add a phone number so you can still get a code if email is down
- Never put real customer details into the shared demo
Spotted a problem?
If you think your account has been accessed by someone else, or you have found a security issue, tell us straight away. We take every report seriously.
Ready when you are.
Set up your shop or website online in a few minutes, or have a look around the live demo first. No card, no contract.