---
title: "Security — Franexis"
description: "How Franexis protects franchise data: PostgreSQL row-level security on every table, franchisee scoping, TOTP MFA with tenant policy, signed webhooks, private storage, and audit logging."
lang: en
json-ld: |
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "position": 1,
        "name": "Home",
        "item": "https://franexis.com/"
      },
      {
        "@type": "ListItem",
        "position": 2,
        "name": "Security",
        "item": "https://franexis.com/security"
      }
    ]
  }
---

[![](/assets/franexis-icon-6T40Ux-2.png)Franexis ](/)

[Product](/product)[Features](/features)[Industries](/industries)[Pricing](/pricing)[FAQ](/faq)[Contact](/contact)

[Log in](/login)[Book a demo](/contact)

Security

# Multi-tenant SaaS is a security claim. Here's ours.

A franchise platform holds many companies' data by definition, so the isolation model is the product. This page describes how Franexis actually enforces it — specifically, not in trust-badge generalities.

## Tenant isolation in the database

Every business table carries a tenant identifier protected by PostgreSQL row-level security. A franchise brand's data is invisible to every other tenant at the query layer — isolation isn't an application promise, it's a database policy.

## Franchisee-level scoping

Within a network, franchisee membership scopes what each location's users can reach. Field technicians are scoped tighter still: assignment-based access to their own work orders and jobs.

## Multi-factor authentication

TOTP-based MFA with hashed recovery codes and administrative reset. Tenants set their own policy — off, required for admins, or required for everyone.

## Roles with server-side enforcement

Six built-in roles from platform admin to field technician. The UI uses permissions only as affordances — every mutation re-checks authorization server-side through row-level security and scoped functions.

## Hardened API surface

External API access uses scoped bearer keys with per-key rate limiting (proper 429 + Retry-After) and idempotency. Webhooks are HMAC-signed outbound and HMAC-verified inbound; public forms carry captcha protection.

## Files and audit trail

Documents, photos, and PDFs live in private storage buckets with path-scoped policies and signed-URL-only access. Administrative and data changes land in an audit log.

The model

## Who sees what, exactly

The tenancy model in one pass — this is the structure row-level security enforces on roughly one hundred tables.

-   A tenant is a franchise brand; franchisees are locations within it 
-   Platform admins (the operator) manage tenants — tenants never see each other 
-   Franchisor roles see across their own network; franchisee roles see their own location 
-   Field technicians see work assigned to them — nothing else 
-   Mobile app users authenticate as themselves and pass through the same row-level security as the web 
-   Data is programmatically yours: documented REST API, webhooks, and exports 

Questions

## Security review?

Evaluating Franexis for your network and need specifics for a security questionnaire? Contact us — we'd rather answer precise questions than publish vague badges.

## Bring your security questionnaire

We'll walk your team through the isolation model, auth, storage, and API security — with the actual policies, not a marketing summary.

[Book a demo](/contact) [View pricing](/pricing)

![Franexis](/assets/franexis-logo-CH7ysA9r.png)

The operations platform for franchise systems. One pane of glass for franchisors, real operational tools for every location.

2029 Woodbridge Blvd. Suite D-2  
Bowling Green, OH 43402  
[(844) 778-3872](tel:+1-844-778-3872)  
[sales@tetracorehq.com](mailto:sales@tetracorehq.com)

### Product

-   [Platform overview](/product)
-   [All features](/features)
-   [Technician mobile app](/features/mobile-app)
-   [Integrations & API](/features/integrations-and-api)
-   [Pricing](/pricing)
-   [Security](/security)

### Features

-   [CRM & lead intake](/features/crm-and-lead-intake)
-   [Field service](/features/field-service-management)
-   [Drying logs](/features/drying-logs)
-   [Inventory & equipment](/features/inventory-and-equipment)
-   [Royalties & finance](/features/royalties-and-finance)
-   [Compliance](/features/compliance)

### Industries

-   [Restoration franchises](/industries/restoration)
-   [Home services](/industries/home-services)
-   [Cleaning & janitorial](/industries/cleaning-and-janitorial)
-   [Emerging franchisors](/industries/emerging-franchisors)

### Compare

-   [Franexis vs PSA](/compare/psa-alternative)
-   [PSA software for franchises](/psa-software-for-franchise-systems)
-   [Franexis vs DASH](/compare/dash-alternative)
-   [Franexis vs Encircle](/compare/encircle-alternative)
-   [Franexis vs Albi](/compare/albi-alternative)
-   [Franexis vs FranConnect](/compare/franconnect-alternative)

### Company

-   [About](/about)
-   [Contact](/contact)
-   [FAQ](/faq)
-   [Privacy policy](/privacy)
-   [Terms of service](/terms)
-   [Log in](/login)

© 2026 TetraCore. All rights reserved.

Franexis is a [TetraCore](https://tetracorehq.com) company — built in Bowling Green, Ohio.