Security Overview
In plain words
Your business data is yours. Each business's data is kept separate from every other business. You decide who on your crew sees what. You can export everything at any time. We are a small team and we say plainly what we do and do not have.
What we do
- Hosting in the United States, on our own servers in St. Louis, Missouri.
- Encryption in transit: thora.cloud and the apps are served only over HTTPS.
- Separation between businesses: every request is checked against the business account it belongs to.
- Role-based access: office users and field crew see what their role allows; the account owner manages roles.
- Payments by Stripe: we never store full card numbers.
- Limited staff access: our people access customer data only to support you or keep the Services running.
- Human approval for sensitive changes to our own systems, with changes reviewed and tested before release.
- Rate limits and abuse controls on sign-in, messaging and AI features.
- Backups of the systems that hold Your Data. After cancellation takes effect, you have 30 days to export Your Data; we then delete it within 90 days of cancellation taking effect, including backups.
What we do not claim
We do not hold SOC 2, ISO 27001, HIPAA or PCI DSS certifications of our own today. Thora One Business is not designed for health records or other regulated data; please do not upload it.
What you can do
- Remove people from your account as soon as they leave.
- Give each person the smallest role they need.
- Use a strong, unique password or passkey for every sign-in.
Report a security problem
Email hello@thora.cloud with "Security" in the subject. Please read our Responsible Disclosure policy first.
Contact us
Questions about this document go to hello@thora.cloud.
Formal legal notices go by email to legal@thora.cloud, as described in the Terms of Service. Thora Cloud LLC is an Ohio limited liability company.