How CORTAN protects access and records.

Account and role controls

The server checks the signed-in account and its permissions. Contractor, customer, employee, and internal staff access are distinct. A requested dashboard URL does not grant its permissions.

Managed internal support access uses provider multifactor authentication and saved role checks. Your account’s MFA requirements are explained during onboarding.

Encrypted connections

The public site uses HTTPS. The private hosted application requires HTTPS and verified TLS for its database connection. Credentials and service secrets are not placed in public page code.

Business and customer records

Requests are checked against the business and customer relationship. Database access is restricted to the permissions the application needs. Customer records, addresses, technician information, and service evidence are not a public directory.

Technician location sharing is optional and limited to the assigned visit. Current location visibility depends on authorization and consent.

Payment handling

The application separates diagnostic consent, additional-work authorization, payment operations, and service records. The public marketing site never asks for card or bank credentials.

Payment-provider setup and account onboarding are required before accepting payments. Screenshots use example data and do not represent real charges or deposits.

Records and accountability

Service decisions and money operations have authorization and event records. Retry protection helps prevent duplicate actions. Access checks also protect the service history and receipt.

Public website privacy

Contractor applications and customer update requests are stored privately for CORTAN review. Optional website analytics records limited page and conversion events only when permitted by your cookie choice.

Read the website Privacy Notice. CORTAN does not sell submitted application information as contractor leads.

Report a concern

Contact [email protected] with the affected page and a description. Do not send passwords, one-time codes, payment details, or private customer records.