Security overview

Named accounts

Every person signs in as themselves. Accounts are not shared between colleagues or within a household.

One residence at a time

A person sees a residence only where an access record exists for them. There is no portfolio-wide view for household accounts.

Roles, not job titles

What a person may do is decided by the role held against their account, checked by the database on every read and write.

Approval limits

Spend authority is a number on the access record. The platform will not accept an approval above it.

Restricted documents

Papers marked restricted are withheld from guest and household roles, and the withholding is itself recorded.

Audit trail

Sign-ins, role changes, approvals, suspensions and document decisions are written to an append-only ledger.

Evidence

Photographs and files are held privately and served through short-lived links, never a public address.

Timestamps

Field work is timed as it happens. Entries are added, not overwritten, so a record cannot be quietly improved.

Accounts use an email address and a password, or an organisation's Microsoft identity where the client uses one. Staff accounts are created by invitation only; there is no open registration. A suspended account loses access immediately and keeps its history.

Traffic between a device and the service runs over TLS. Records and uploaded files are held by our hosting provider with encryption at rest, and are reachable only through the access rules described above. Details of the hosting arrangement, including region and the provider's own certifications, are supplied to clients on request rather than summarised here, so that the answer you receive is current.

A manager's phone holds the day's work, sometimes without signal. Entries queue locally and synchronise when the connection returns. Signing out clears the queue and the cached file from the device.

If you believe you have found a vulnerability, write to the office before publishing anything. Tell us what you found and how to reproduce it. We will acknowledge within three working days, keep you informed while we fix it, and we will not pursue anyone who reported in good faith and did not access another person's data.

Where a breach affects a client's personal data, we notify the client without undue delay once we understand what happened, together with what we know, what we have done, and what we advise. Statutory notifications to the supervisory authority are made where the law requires them.