Independent testing
Not yet. SilverTech Master System hasn't had an independent penetration test or third-party audit so far. One is planned, covering the web app and the PC agent, and we'll publish a summary of the results on this page.
In the meantime, we review the code for security problems ourselves and fix what we find. The most recent review was in November 2026. That's our own work, not an independent audit.
Your workspace and data
- Every workspace has its own separate database. Your clients, computers and records are never stored with another business's.
- Passwords are stored only as one-way hashes. Secrets such as remote access passwords, email sending keys and payment keys are encrypted before they're stored.
- Card payments are handled by Stripe. We never see or store full card numbers.
- Everything travels over HTTPS, and the service sits behind Cloudflare's protection against attacks.
Signing in
- Two-step sign-in with an authenticator app, with recovery codes for a lost phone. Remote access requires it.
- Accounts lock after repeated wrong passwords. You choose how many attempts, and for how long.
- You can limit sign-ins to your own network addresses, and choose how long an idle session stays signed in.
- Forms are protected against cross-site request forgery, and requests from other websites can't change anything in your workspace.
Your team
- Technicians each have their own sign-in, and you can limit them to the clients you choose. The server enforces those limits, not just the screen.
- The console is only for technicians you allow to use it.
- An activity log records sign-ins, remote access, console sessions and other important changes, with who did them.
Our access to your workspace
We can't open your workspace on our own. To help you, we need the support code shown in your Settings. It changes every 72 hours, access ends 12 hours after it's entered, and you can make a new code at any time to end it right away. Repeated wrong codes are blocked.
The PC agent
- Each computer gets its own random key when the agent is installed, and every report and command goes over HTTPS.
- The agent's folder can only be changed by administrators and the system, so a normal user on the computer can't swap its files.
- It collects technical details: hardware, disk and battery health, updates, security settings, network and backup status, and the signed-in user's name. It doesn't collect documents, email, browsing history or keystrokes.
- A new key can't take over another computer's card while that computer is still reporting.
- Scripts and console commands run only when someone in your workspace starts them, or on a schedule you set. Everything run in the console is logged, and an idle console closes after 15 minutes.
Remote access
- Remote access uses RustDesk, installed and kept up to date by the agent, through our own relay server.
- Each computer's unattended password is stored encrypted and changed regularly. You can require that the person at the computer accepts every session.
- Every connection, and every time a password is shown, is written to the activity log.
Websites
- Server code in customer website pages never runs. HTML, CSS and JavaScript are kept, and PHP is removed.
- Website previews on our own address run in a browser sandbox, so a page's scripts can't act with the signed-in viewer's account.
- Uploads are checked by their actual contents, pictures are re-encoded, and nothing in an upload folder can run as code.
Report a vulnerability
If you think you've found a security problem, please email [email protected] or use our contact page, with the steps to reproduce it. We'll confirm we got it, keep you updated while we fix it, and credit you if you'd like.
Please test only against your own account or trial workspace. Don't access or change anyone else's data, don't disrupt the service, and give us a reasonable time to fix the problem before you share it publicly.
Last updated November 15, 2026. See also our privacy policy.