Honest security posture

What we protect, and what we don’t claim.

Tenant isolation

Every customer is a separate organization. Access is enforced with PostgreSQL row-level security on every table, not by hiding buttons. Platform operators have no tenant membership and cannot read evidence through the product.

Authentication

Email and password with a 12-character minimum.
Owners and QA managers require a second factor for privileged actions.
Ownership transfer requires both parties and two verified authenticators.
Session tokens are stored in encrypted native storage on mobile.

Evidence and reports

Four private storage buckets: inspection evidence, corrective evidence, report assets and exports.
Signed access is short-lived; share links are tokenized, expiring and revocable.
Approved reports are frozen revisions with content hashes and an audit trail.

Backups

Encrypted database and object backups are written to private object storage, with SHA-256 manifests and restore verification. Backups are encrypted with a key held outside the storage provider. Restore drills have been performed, including nonempty evidence objects.

Retention

Share links expire by policy. Organization closure disables access and revokes sharing but does not automatically purge evidence. A legally reviewed retention and purge schedule is still being finalized; we will not pretend otherwise.

Subprocessors

Provider	Purpose	Region
Supabase	Database, authentication, private storage	Singapore (ap-southeast-1)
Cloudflare	Web hosting, Workers, PDF rendering, encrypted backup storage	Global edge
Resend	Transactional email (being configured; not yet active for production)	United States

What is not ready

Production transactional email is not live; pilot onboarding is manual.
Native Android and physical-device testing is incomplete.
No independent penetration test has been published.
Data residency options beyond the current region are not offered.