Access
Gage uses sign-in systems designed to avoid passing reusable passwords around. Accounts and organizations have boundaries so people see the work they are authorized to see.
We keep operational access limited to people who need it and record sensitive administrative activity where the system supports it.
Connections and storage
Connections to Gage use encryption in transit. Production information lives on managed infrastructure with access controls and encryption at rest. We separate public marketing pages from the application so an application failure does not have to take the public site with it.
Field devices
Gage is designed to keep field work available when the network disappears. That means authorized work may be stored on a device long enough to keep the day moving and synchronize later.
Protect phones and computers with a device passcode, current operating system, and automatic locking. Remove a person’s access when they leave and tell us quickly about a lost device.
Software and changes
We review changes, restrict production credentials, keep dependencies current, and test the paths that carry customer work. Security fixes receive priority according to their risk.
No system is invulnerable. We choose controls that reduce the chance of trouble, narrow its reach, and leave enough evidence to understand what happened.
When something happens
We investigate suspected incidents, contain affected systems, restore safe service, and notify affected customers when the facts or law call for it. We would rather report what we know and what remains uncertain than dress an incident in confident fog.
Report a concern
Send the report straight to the people who can act on it.
Found something that could put Gage or our customers at risk? Send the details to hello@meetgage.com. Include the affected page or feature, what you observed, and a safe way to reproduce it. Please do not access another customer’s information or disrupt the service while investigating.