Trust & Security

Your work data, handled with care

CanTicket helps service teams manage jobs, time, and invoicing. We know that means trusting us with client names, financial data, and day-to-day operations. This page explains how we protect that information.

Report a security concern Request our DPA

Last updated: July 2026

01

What we do

CanTicket is a cloud-based job and workflow platform for businesses that track work, time, and billing — often alongside Xero and other tools you already use.

We process data you and your team enter into the product: jobs and tasks, time entries, comments, client and contact details, invoices and quotes (including data synced from connected accounting systems), and account information for your users.

We do not sell customer data. We use it only to provide and improve the service described in our Terms of Service and Privacy Policy.

02

How we protect data

Encryption

AreaDetail
In transitAll connections to CanTicket use HTTPS (TLS 1.2+).
At restCustomer data is stored in encrypted MySQL on AWS in Singapore (ap-southeast-1).
PasswordsStored using industry-standard hashing — never in plain text.
SessionsEncrypted session cookies in production; secure cookie flags when served over HTTPS.

Access control

  • Role-based access — Admin, manager, contractor, client, and other roles see only what their role allows.
  • Company isolation — Data is scoped by company (tenant) so one customer's data is not visible to another.
  • Internal access — CanTicket staff access to customer environments is limited, logged, and restricted to authorised support and operations personnel only.
  • Authentication — Login verification and optional OTP flows for account security.

Application security

We maintain an active security improvement program, including:

  • Regular internal security reviews of our application code
  • Automated testing and style checks on critical paths before release
  • Webhook authentication for inbound integrations (email-to-ticket, Xero, CRM, and others)
  • Input validation and output encoding to reduce cross-site scripting and injection risks
Details of our remediation program are available to enterprise customers under NDA.

Infrastructure

ItemOur approach
HostingAmazon Web Services (AWS)
Primary regionSingapore (ap-southeast-1)
AvailabilityUpdate coming soon
BackupsRegular automated backups, stored securely and not publicly accessible.
MonitoringApplication and infrastructure logging; alerts on errors and failed jobs.
03

Subprocessors

We use carefully selected third parties to run CanTicket. They process data only on our instructions and for the purposes below.

ProviderPurposeTypical data
Amazon Web Services (AWS)Application and database hostingAll customer account and job data
Amazon Web Services (SES)Transactional emailEmail addresses, message content
StripeSubscription and payment processingBilling contact, payment metadata (Stripe handles card data)
XeroAccounting integration (optional per customer)Invoices, contacts, payroll/timesheet sync as configured
GoogleCalendar, Drive, Maps (optional per customer)OAuth tokens, calendar events, files as authorised
OpenAI / Google GeminiAI-assisted features (optional per company)Prompts may include job and comment text when features are enabled
GoHighLevelCRM sync (optional)Contacts and opportunities as configured
SlackJob commands (optional)Workspace tokens, job metadata
AsanaIntegration and browser plugin (optional)Task and time data as authorised
Full register: Available on request — [email protected]. We review subprocessors periodically and update this list when we add or change providers.
04

Artificial intelligence (AI)

Some CanTicket features can send portions of your job or comment text to AI providers (such as OpenAI or Google Gemini) when your company has enabled those features.

You control this

  • AI features are configured per company
  • You can disable AI features if you do not want content processed by third-party LLMs
  • Where supported, you may use your own API keys
We recommend not entering passwords, payment card numbers, or highly sensitive personal health information into AI prompts. More detail is available in our AI data handling summary on request.
05

Your responsibilities

Security is shared. We recommend customers:

  • Use strong, unique passwords and limit admin accounts to people who need them
  • Review user access when staff leave or change roles
  • Connect integrations (Xero, Google, Slack) only with accounts you trust
  • Report suspicious activity to us promptly
06

Incident response & breach notification

We maintain an incident response plan covering detection, containment, assessment, customer notification, and post-incident review.

If we confirm a security incident that affects your data, we will:

  1. Investigate and contain the incident without undue delay
  2. Assess what data and which customers may be affected
  3. Notify affected customers and, where required by law, relevant regulators — our target is to begin customer notification within 72 hours of confirming a notifiable breach
  4. Remediate root cause and share summary findings where appropriate
Report a vulnerability or incident: [email protected]. We appreciate responsible disclosure and will acknowledge reports within 2 business days.
07

Compliance & certifications

StatusDetail
ISO 27001Underway
PrivacyAustralian Privacy Act 1988; see our Privacy Policy for international transfers (including Singapore hosting)
Security auditInternal application security audit completed June 2026; critical findings remediated
Enterprise customers may request our security overview, subprocessor list, and DPA under NDA.
08

Data retention & deletion

Data typeTypical retention
Active account dataDuration of subscription, plus a defined grace period after termination unless law requires longer Update coming soon
BackupsRetained on a rolling basis and rotated regularly; stored securely and not publicly accessible.
LogsSecurity and access logs retained for monitoring, troubleshooting, and investigation purposes.
To request export or deletion of your organisation's data, contact [email protected]. Some records may be retained where required for legal, tax, or fraud-prevention purposes.
09

Contact us

Send a message and we'll open a triage ticket routed to the right team. For security reports we acknowledge within 2 business days.

Your message creates a triage ticket. We never share your details with third parties for marketing.

Ticket created

Thanks — your request has been logged and routed to the right team. You'll receive an email confirmation shortly. Keep this reference for follow-up:

RefCT-000000
10

Marketing website (cookies & analytics)

Our public website (canticketapp.com) may use cookies and third-party analytics to understand how visitors find our marketing pages. This section does not describe the in-app CanTicket product your team uses for jobs and time tracking.

ServicePurpose
Google AnalyticsTraffic and usage on marketing pages
Meta (Facebook) PixelAdvertising measurement and remarketing
Google Search ConsoleSearch performance and site indexing (site-owner tool)
Details are in our Privacy Policy. To opt out of marketing cookies, use your browser settings or the controls described in our Privacy Policy. Product support: [email protected]
Site Directory — CanTicket
Site Directory

Keep profits up and the team in check.

Every CanTicket page in one place — the product, the use cases, the integrations. Search, or jump straight in.

Book a demo Profit Leak Calculator or go direct: canticketapp.com/book-a-demo
How can we help?

AI, dashboards & the future of work

7

Where AI stops being a talking point and starts showing up in the numbers. CanTicket meters what AI costs per job the same way it meters people, connects to the rest of your stack through its API, and reports both to the finance and board views that need them.

/ai-token-tracking

AI Token Tracking

Meter every AI action and attribute its token cost to the job, client or department that caused it.
/connecting-apis

Connecting APIs

Connect CanTicket to the rest of your stack — what the API exposes, how authentication works and what syncs.
/chrome-extension

Chrome Extension

Log time, open jobs and capture work from any tab without leaving the browser.
/cfo-dashboard

CFO Dashboard

Live margin, cost-to-serve and cash position in one view built for the person who owns the numbers.
/board-dashboard

Board Dashboard

Board-ready reporting on revenue, utilisation and profitability, current to today rather than last quarter.
/ai-vs-human-labour-costs

AI vs Human Labour Costs

Compare what a task costs done by a person against the same task done by AI, on your own rates.
/future-of-work

The Future of Work

How AI changes what service businesses charge for, and what stays human when it does.

Main pages

13
/

Home

Job management and live margin visibility — the CanTicket homepage.
/pricing

Pricing

Plans, what's included and how billing works.
/solutions

Solutions

What CanTicket does, framed by the outcomes it delivers.
/calculator

Profit Leak Calculator

See what unbilled time and hidden cost is quietly costing you.
/xero

Xero Integration

Real cost pulled from Xero, mapped live to every job.
/book-a-demo

Book a Demo

See CanTicket walked through against your own numbers.
/registration

Registration

Start your CanTicket account.
/faqs

FAQs

Common questions about the product, data and setup.
/blog

Blog

Articles on margin, operations and AI for service businesses.
/about-us

About Us

Who we are and why we built CanTicket.
/contact-us

Contact Us

Get in touch with the team.
/security

Security

How CanTicket protects and handles your data.
/death-by-subscription

Death by Subscription

Our campaign on tool sprawl and runaway subscription cost.

By industry & team

10
AtlasAtlasKeeps the team in balance
/erp-for-small-business

ERP for Small Business

Enterprise-grade job, time and margin control, sized and priced for small teams.
/professional-services-erp

Professional Services ERP

Built for firms that bill for people's time and expertise.
/erp-for-consulting-firms

ERP for Consulting Firms

Track engagements, utilisation and realised margin.
/erp-for-it-services

ERP for IT Services

Manage projects, tickets and recurring work in one place.
/erp-for-agencies

ERP for Agencies

Run client work, retainers and projects with live profitability on every job.
/erp-for-marketing-agencies

ERP for Marketing Agencies

Track campaign and retainer margin across every client in real time.
/erp-for-creative-agencies-6928

ERP for Creative Agencies

Keep creative projects profitable without killing the creative flow.
/erp-for-distributed-teams

ERP for Distributed Teams

One source of truth for jobs, time and cost across every location and timezone.
/project-based-erp

Project-Based ERP

Margin visibility for teams that deliver work project by project.
/erp-500k-5m-revenue

ERP for $500K–$5M Revenue

The right-sized system for growing businesses outgrowing spreadsheets.

Capabilities & features

9
MadiMadiYour margin watchdog
/project-profitability-software-775967

Project Profitability Software

See the real profit on every project as the work happens, not months later.
/job-costing-software

Job Costing Software

Accurate cost per job from real time and expenses, mapped to your Xero.
/real-time-margin-tracking

Real-Time Margin Tracking

Live margin on every active job, so you catch a leak while you can still fix it.
/xero-erp-integration

Xero ERP Integration

Two-way Xero sync that turns your accounting data into live job margin.
/cloud-erp-small-business

Cloud ERP for Small Business

A modern, cloud-based ERP with nothing to install and no IT overhead.
/ai-erp-software

AI ERP Software

An ERP with an AI team that watches margin, capacity and admin for you.
/business-management-software-sme

Business Management Software

Jobs, time, billing and margin in one system instead of four tools and a spreadsheet.
/digital-transformation-sme

Digital Transformation for SMEs

Replace the spreadsheet stack with one connected, real-time source of truth.
/erp-roi-calculator

ERP ROI Calculator

Estimate what real-time margin visibility is worth to your business.

Integrations

6
OptiOptiKills the admin tax
+ CanTicket

Bring Asana work into live cost and margin tracking.

/canticket-asana
+ CanTicket

Turn Trello boards into costed, billable work.

/canticket-trello
Slack+ CanTicket

Push job, margin and approval alerts straight into your channels.

/canticket-slack
Google Drive+ CanTicket

Attach job files from Drive without duplicating a single folder.

/canticket-google-drive
Google Calendar+ CanTicket

Two-way sync between scheduled jobs and your team calendars.

/canticket-google-calendar
Coming soon

Map monday.com boards to real-time job margin.

In development

*monday.com is in development — everything else here is live today.

Compare & alternatives

6
/erp-alternative-myob

MYOB Alternative

How CanTicket compares to MYOB for job and margin management.
/erp-alternative-netsuite

NetSuite Alternative

A lighter, faster alternative to NetSuite for service businesses.
/replace-asana-harvest-xero

Replace Asana + Harvest

Bring Asana, Harvest and spreadsheets into one system that plugs straight into Xero.
/accountant-recommended-erp

Accountant-Recommended ERP

The job and margin system accountants point their clients to.
/advisor-recommended-business-software

Advisor-Recommended Software

Why advisors recommend CanTicket to clients who need real numbers.
/erp-alternative-sap

SAP Alternative

A far lighter alternative to SAP for service businesses that need job margin, not a multi-year rollout.

The app

2
users.canticketapp.com

Dashboard

Sign in to your CanTicket workspace.

Opens the app
users.canticketapp.com/login

Log In

Access your account.

Opens the app

No pages match that search

Try a different word, or clear the search to see everything.

Watch it work

See CanTicket in two minutes

A quick tour of live job margins, the Xero sync, and the AI team keeping every job honest.

CanTicket product tour
Product tour
2 min · margins, Xero & the AI team

See where your margin really goes.

Book a walkthrough and we'll show you CanTicket — ERP, job costing and real-time margin software for small business and professional services teams — mapped to your own jobs and your own Xero.

Book a demo Get started

Quick answers

See all FAQs

CanTicket is cloud ERP and job management software for small businesses and professional services teams. It brings project management, time tracking, job costing, invoicing and staffing into one system with live margin visibility, so you can see exactly what every job, client and staff member is earning or costing in real time — connected to the Xero you already run.

Project management tools like Asana, Trello and Monday show you what work is happening, but not what it is worth. CanTicket is job costing and project profitability software as well as a small business ERP — it tracks real-time margin on every job, so you manage profit, staffing and capacity, not just task status.

Yes. CanTicket offers a two-way Xero ERP integration that pulls real cost, payroll and invoice data straight from Xero and maps it to every job. Your job costing and margin reporting run on actual accounting numbers, not estimates — which is why it is popular accountant- and advisor-recommended small business software.

CanTicket is built for service and project-based small businesses — agencies, marketing and creative studios, consulting firms, IT services and professional services teams, typically between $500K and $5M in revenue. If you deliver work through people's time and need better ERP, staffing and profitability visibility than spreadsheets can give, CanTicket is for you.

CanTicket uses one flat per-seat price with everything included — job management, job costing, project profitability, real-time margin tracking, Xero integration and the AI team — with no feature gating and no per-tier gouging. See the pricing page for current rates.

Most teams migrate in a few clicks. Your boards, tasks, time and staffing come across from tools like Asana, Harvest and Trello, and CanTicket connects straight to Xero — so you are adding real-time margin and ERP visibility to your existing workflow, not rebuilding your small business software stack from scratch.

Yes. Data is encrypted in transit and at rest, tenant-isolated per company, and never sold. Full detail on our security and privacy practices is on the security page.

Yes. Every AI action the CanTicket team takes — Madi checking margin, Atlas balancing capacity, Opti clearing admin — is metered and attributed to the job, client or department it ran for. AI consumption shows up as a real, itemised cost line alongside labour and expenses, not as an invisible platform fee, so you always know what the automation is costing you and where it is being spent.

AI is quietly becoming a real operating expense, and in most businesses it sits in a single unallocated software bill nobody can break down. Tracking consumption per job puts that spend where it actually belongs: your job costing and project profitability numbers include the cost to serve, your margin reporting stays honest, and the expense flows into Xero already coded — so your accountant, your board and your clients see the same defensible figure.