Trust
Security and data protection
Your workshop's data belongs to your workshop. BayAutomate keeps each workshop's records separate, checks every request against the user's role on the server, stores passwords only as one-way hashes, uses long random private links for customers and keeps an audit history of important actions. The main database is located in Sydney, Australia.
Early access: BayAutomate is onboarding Australian workshops now. Anything marked Coming soon or Planned isn't available yet. Everything else is included on every plan.
Workshop data isolation
Every record belongs to one workshop, and every request is checked against the signed-in user's workshop on the server. Automated tests try to read and change other workshops' records and confirm they are refused.
Access control
- Roles (owner, adviser, technician and more) are enforced on the server, not just hidden in the screen.
- Owner-only actions include automation settings, Xero connection, credit overrides and statement approval.
- Sign-in sessions expire after 12 hours.
- Passwords are stored only as bcrypt hashes. We can't see them.
Customer data protection
- Quote approval and account links use long random tokens (32 characters), can expire, and are blocked from search engines.
- Marketing messages need recorded consent. Opt-outs are honoured everywhere.
- Internal notes are never shown to customers.
- Website analytics, when enabled, never receives names, emails, phone numbers, vehicles or private links.
Audit history
Important actions are recorded with who, what and when. That includes owner overrides (with the reason, amount and account status), statement approvals and sends, payment allocations and reversals, invoice automation decisions and settings changes.
Safe by design
- Practice mode keeps test sales and invoices out of real reports, stock and accounting.
- Payments, statements and postings are idempotent, so retries and double-clicks don't create duplicates.
- Background jobs commit step by step and resume safely after a restart.
Hosting and backups
The BayAutomate database runs on a managed PostgreSQL service in Sydney, Australia. Application servers are run by our cloud platform provider, and some may be outside Australia. Backups are handled by the database provider under our service plan. You can ask us for a full export of your workshop's data at any time. See Data processing for the providers we use.
Report a security issue
Email privacy@bayautomate.com.au. We acknowledge reports promptly and will keep you updated.
Questions
Can another workshop see my customers?
No. Every record is tied to your workshop and every request is checked on the server. Automated tests confirm cross-workshop access is refused.
Where is my data stored?
The main database is in Sydney, Australia. Some processing, such as AI invoice reading, uses providers outside Australia. See Data processing.