Security and data protection

Your records have to survive a request for proof years later. Here is how they are protected in the meantime.

Your account’s data is isolated in the database

Access control is applied by row-level security in Postgres, not by application code that could be bypassed. A query for another account’s assets returns nothing, whatever the client asks for.
Least-privilege roles

Role-based access with team scoping, so people see the assets and sites they are responsible for. Contractors get scoped access to the job they are on and nothing around it.
A complete audit trail

Creates, edits, approvals, exports and consent decisions are recorded with who, what and when, and can be exported on request.
Encryption in transit and at rest

TLS on every connection, AES-256 at rest, and HSTS with preload on all public surfaces.
Two-factor authentication

TOTP-based 2FA is available on accounts, with authenticator-app enrolment and recovery codes.
Consent captured and re-confirmed

Consent is recorded at sign-up against a specific policy version, and people are asked again when a policy materially changes. Every policy version stays queryable for later review.
Self-serve deletion

Deleting one person, or your whole company account, is done in the product, with scheduled purge jobs that remove the data rather than flagging it.
UK and EU hosting

Data is held in the UK/EU. A signed Data Processing Agreement is available, and our sub-processors are published.

Documents you can read before you sign up

Each one is the actual document, not a badge.

Send us your questionnaire. We answer it ourselves, and we say when the answer is no.