How MEPSub keeps your company’s data encrypted, backed up and available, who can see what, and what we do and don’t claim. Plain language, no badges we haven’t earned.
Customer data — databases, uploaded files, logs and backups — is encrypted at rest with AES-256, on the main server and on the standby.
Every connection to MEPSub uses TLS 1.2 or newer. Sign-in tokens for apps you connect (Procore, Google, QuickBooks and others) are sealed with AES-256-GCM in the database.
The database is copied continuously to a second storage system and mirrored off site, with daily snapshots and nightly backup sets kept 7 days, 4 weeks and 3 months. Off-site copies are encrypted before they leave.
A second, separate server keeps a copy of the app and the data, refreshed every hour after an automatic restore and integrity check. Phone calls already fail over to it, with a test call every day.
The standby checks the main server every 20 seconds. If it stops answering, the on-call person gets a text and a call, then the backup person, then everyone.
Your data is stored and processed in the United States.
Authenticator-app codes (TOTP) for your team, the customer portal and the vendor portal — with backup codes — and an admin switch to require it, in the phone app too.
Session tokens are stored only as hashes. Everyone can see where they are signed in and sign out all other devices, on the web and the phone.
More than 200 permissions across every module, each None, Read or Full, limited to your own records or all. Prices and margins stay hidden from roles that should not see money, and nobody can grant more than they have.
Owners and admins see who changed invoices, payments, bills, estimates, change orders, rates, roles and approved time — with the value before and after. Phone call-flow changes are logged with a one-click Put back.
Security headers on every page, uploaded files served in a sandbox, protection against server-side request forgery and spreadsheet formula injection, automated code and dependency scanning, and a weekly web vulnerability scan.
Sign-in attempts are limited per account, texted portal codes and voicemail PINs lock after a few wrong tries, and public forms carry signed spam guards.
Shared file links can have a password, an expiry date and a download limit, and can be revoked. Large email attachments go as links that expire after 30 days.
Calling is limited to the US and Canada, expensive look-alike destinations are blocked, and each company has usage caps and alarms on unusual spikes.
Mail MEPSub sends is aligned for SPF, DKIM and DMARC; your own sending domain gets the DNS records it needs. Incoming mail that fails DMARC or SPF is flagged.
Card and bank (ACH) payments, portal autopay included, go through Stripe Checkout.
MEPSub uses AI for takeoffs, estimates, documents, emails and the phone receptionist. It is there to save typing, not to act on its own.
| Stripe | Payments |
| Anthropic | AI features |
| Telephony carriers | MEPSub Phone calls and texts, when Phone is on |
| Encrypted off-site backup storage | Backups |
| Google, Microsoft, Dropbox, QuickBooks, Procore | Only when you connect them |
Services we use to run MEPSub. Connected apps only see what you connect.
Yes. Data is encrypted at rest with AES-256 — databases, files, logs and backups — and every connection uses TLS 1.2 or newer.
In the United States.
A second, separate server keeps an hourly-checked copy of the app and the data and is watched around the clock, and phone calls already fail over to it automatically. The database is also replicated continuously and backed up off site.
Not today. We describe exactly what we do on this page instead, and we are glad to fill in your security questionnaire.
Yes. An admin can require it for the whole company, and it is enforced in the phone app too. Customer and vendor portal users can use it as well.
Roles and permissions decide it, screen by screen and record by record — prices and margins can be hidden from field roles — and the audit trail shows who changed money and time records.
Email support@mepsub.org with “Security” in the subject. We read every report and answer within one business day.
Send it over. We’ll fill it in with what MEPSub actually does — and say so where we don’t.