Security and data protection
Your records have to survive a request for proof years later. Here is how they are protected in the meantime.
Coming soon Request a demo
Documents you can read before you sign up
Each one is the actual document, not a badge.
Security and data protection
-
Your account’s data is isolated in the database
Access control is applied by row-level security in Postgres, not by application code that could be bypassed. A query for another account’s assets returns nothing, whatever the client asks for.
-
Least-privilege roles
Role-based access with team scoping, so people see the assets and sites they are responsible for. Contractors get scoped access to the job they are on and nothing around it.
-
A complete audit trail
Creates, edits, approvals, exports and consent decisions are recorded with who, what and when, and can be exported on request.
-
Encryption in transit and at rest
TLS on every connection, AES-256 at rest, and HSTS with preload on all public surfaces.
-
Two-factor authentication
TOTP-based 2FA is available on accounts, with authenticator-app enrolment and recovery codes.
-
Consent captured and re-confirmed
Consent is recorded at sign-up against a specific policy version, and people are asked again when a policy materially changes. Every policy version stays queryable for later review.
-
Self-serve deletion
Deleting one person, or your whole company account, is done in the product, with scheduled purge jobs that remove the data rather than flagging it.
-
UK and EU hosting
Data is held in the UK/EU. A signed Data Processing Agreement is available, and our sub-processors are published.
Running a security review?
Send us your questionnaire. We answer it ourselves, and we say when the answer is no.
Coming soon Request a demo