Security
Your data, in its own database.
How Works is built, what we do, and what we do not have yet. Written plainly, because your IT department is going to ask anyway.
The architecture, first
Every client runs on their own WordPress installation with their own database, on their own subdomain. There is no shared multi-tenant schema.
In most safety platforms every customer’s data sits in the same tables, separated by a column and a query filter. A mistake in that filter, or a permissions bug, exposes one customer’s records to another. Here there is no query that could reach another client’s data, because it is in a different database.
It also means your configuration, your forms, and your branding are yours. Nothing about your setup is constrained by what another customer needs.
What we do
The controls that are in place today.
Access
- Multi-factor authentication required on administrator accounts
- Role-based access enforced on the server
- A foreman sees only their own scope
- No public registration on any client installation
- Administrative access limited to named staff
Data
- Encrypted in transit with TLS on every installation
- Hosted in the United States, single region
- Separate database and separate system account per client
- Automated backups on a scheduled cadence
- Your uploaded documents stay in your installation
Operation
- Automated daily health monitoring across every installation
- Failures alert us before you notice them
- Security plugin monitoring on every site
- Version-controlled deployment with a documented runbook
- Change history on every release
Straight answers to the usual questions
| Question | Answer |
|---|---|
| Is our data separated from other customers? | Yes. Separate database and separate installation per client. |
| Where is it hosted? | United States. |
| Is it encrypted in transit? | Yes, TLS. |
| Do you have a SOC 2 report? | No. We have not been through a SOC 2 audit. We would rather say so now than three weeks into your evaluation. |
| Has the platform been penetration tested? | Not yet. It is on our list. |
| Do you support single sign-on? | Not yet. Multi-factor authentication is available today. |
| Do you publish an uptime SLA? | No. We would rather not publish a number we cannot stand behind on our current architecture. We will tell you honestly what our availability has actually been. |
If your procurement process needs a questionnaire completed, send it. We answer them.
What we are honest about
We are a safety consulting firm that builds software, with a small team and no compliance department.
If your organization requires SOC 2 before signing, we are not the right vendor today, and you should know that before you spend three weeks on an evaluation. If your organization wants to know whether its data is properly separated, monitored, and backed up, the answers are on this page.
Send us the questionnaire.
Send it over and we will fill it in.