Security
How we protect your organization’s operational data.
Tenant isolation
Every organization’s records are scoped by a server-enforced tenant context that fails closed. Cross-organization access is covered by automated negative tests on web routes and the API.
Access control
Granular permissions grouped into roles, with scope by organization, region, location or own assignments. Permissions are enforced on the server for every request, export and API call.
Authentication
Strong password hashing, email verification, optional two-factor authentication and passkeys, login throttling and session management.
Evidence storage
Photos and documents are stored privately, validated by file content, renamed on upload and served only to authorized users through short-lived links. Image metadata such as GPS location is removed.
Audit trail
Sensitive actions are written to an append-only, hash-chained log with actor, time, request ID and reason. A verification command detects tampering with stored entries.
Support access
Our support team cannot open your operational records unless an administrator grants time-limited access, which you can revoke at any time.
Infrastructure
HTTPS everywhere, secrets in protected environment configuration, dependency scanning in CI and documented backup and restore procedures.
Report a vulnerability: [email protected]