"We", "us" and "Dcypher-IT" means Dcypher-IT LLC, the company that publishes and, for the hosted edition, operates BOSS HQ. "You" means the business that has an account and every person who signs in on that business's behalf. Questions about this policy go to the support address shown inside the application (Help → Get help).
It covers the hosted edition of BOSS HQ (the version we run on our servers for you) and the personal information that passes through it. If you run BOSS HQ on your own server (the on-premises edition), you are the operator of that installation and this policy applies only to what reaches us: license checks, support tickets and payments.
Account information. The name, username, email address, cell number (if given), role and sign-in settings of each person with an account, including whether two-factor sign-in or a passkey is enrolled. Passwords are stored only as one-way hashes.
Your business records. Everything you enter or import: customers, vendors, employees and their pay details, invoices, bills, bank transactions, documents, photographs, messages, time punches with the location recorded at the punch, jobs, court cases, and for law firms the matters, time entries and trust ledgers. This information belongs to you. We process it only to run the service for you.
Sealed fields. Certain fields are encrypted with a key held only on the server that runs your installation and are shown to staff only in part: taxpayer identification numbers and Social Security numbers on trade account applications, backup passphrases, and the credentials of third-party services you connect (PACER, Docket Alarm, Clio, QuickBooks, Microsoft 365). Revealing a sealed field requires a fresh two-factor code and is written to the audit log.
Sign-in and audit records. Every sign-in attempt (successful or not) with the username tried, the source address, the time and the outcome; every action in the audit log with who did it and when; every reveal of a sealed field. These records exist so that you can answer "who did what" and so that we can detect misuse. Client-portal sign-ins are recorded the same way.
Support tickets. When someone opens a support ticket from inside the application, the ticket carries the page they were on, the software version, whether the books balance, and a snapshot of what that screen was showing: the last errors the browser recorded, the last requests it made, the pages visited in that session, the visible text on the screen and any open dialog, the browser and window size. This is sent to our support mailbox and kept with the ticket so that we can reproduce the problem without asking. Do not put card numbers or passwords in a ticket.
Operational logs. Server logs (request paths, timings, errors), health checks, integrity checks and restore-drill records. These contain little personal information beyond addresses and usernames and are kept for a short period.
Decoy addresses and files. The service runs decoy addresses and files (a honeypot) that no ordinary use of the product touches. A request to one of them is recorded with the source address, the time, the path requested, the browser identification and the request headers, and kept for 180 days. We may use these records to block the source address and may share them with law enforcement. Credentials sent to a decoy are noted as having been sent but are never stored.
Payments. For the hosted edition we bill through Stripe. Stripe holds the card details; we hold the customer identifier, the plan, invoices and payment status. We never see the full card number.
We use the following categories of providers. The current list is available on request and inside the application under Administration → Email & Integrations. We tell you before adding a new category.
Hosted installations run in the United States unless your plan states another region. If you are subject to a law that restricts transfers (for example the GDPR for a European client of a US firm), the data-processing addendum sets out the transfer mechanism.
You can export everything at any time (Import / Export → Export everything, and the sealed backup copies) and you can ask us to delete your installation. If you are a person whose information is in a customer's installation (a customer, employee or client of theirs), the customer is the controller of that information and requests should go to them; we will help them answer. Where a law gives you a right to access, correct, port or delete your information, or to object, you may exercise it through the customer or by writing to us, and we will act within the time the law allows.
Two-factor sign-in (mandatory for law firms' client portals and available to everyone), passkeys, lockouts, session expiry, encrypted sealed fields, encrypted backup copies, full database integrity checks on a schedule, a rehearsed restore every month, a public status page, and an audit trail of who did what. No system is perfectly secure; if we learn of a breach affecting your information we will tell you without undue delay and, where the law sets a deadline, within it.
BOSS HQ is a business tool and is not directed at children under 16. We do not knowingly collect their information.
We use a session cookie to keep you signed in and a small amount of browser storage for conveniences (the last company you chose, punches held while offline, unsent drafts). No advertising or tracking cookies.
BOSS HQ Fill is an optional Chrome/Edge extension that places a credential from your company's credential vault into a login form, so a technician can sign in without seeing the password. On your computer it stores only your BOSS HQ server address and a pairing token, both removed when you unpair. When you click "Find credentials for this site" it sends the current page's address to your own BOSS HQ server and nothing else; when you click "Fill" your server returns that one credential, the extension places it in the form and discards it, and your server records the fill (who, which credential, which site, when) in the audit log your managers can see. The extension acts only on the tab where you click it, asks the browser for permission to reach one address only (the server you paired), never contacts any other server, and keeps no passwords, history or page content. Its handling of authentication information is limited to that single purpose and is never sold or shared.
When this policy changes materially we update the version line above, and the software asks each signed-in person to acknowledge the new terms.