Security
Security, stated plainly.
What Siteproof does to keep your data separate, private and intact, and what it does not claim yet. If your procurement team has a security questionnaire, send it to us and we will answer it in writing.
Your organisation is the boundary
Every signed-in request is resolved to your organisation and your membership on the server before any record is read or written. IDs sent by a browser are never trusted as authority, and the browser never holds a database key. Public form links are the one exception: each is tied to a single form by its own token and can only add a response to it.
Private files, short-lived links
Photos, signatures and documents are kept in private storage. A download is a signed link that expires within five minutes, issued only after the server has checked who is asking.
Records that cannot be quietly changed
Published form versions, contract setup versions, the delivery quantity ledger, installer allocations, checkpoints and commercial documents are locked by the database. A correction is a new record that cancels, reverses or supersedes the old one.
Sign-in
Accounts, sessions and organisation membership are handled by Clerk. Siteproof then applies its own checks: role, assignment, contract rules and record ownership all narrow what a signed-in person can do.
Data on the device
Offline Project data is stored in the browser for the signed-in person only. A confirmed sign-out or removed access clears it; a network outage never does. Siteproof does not add its own encryption on the device, so use device passcodes and your mobile device management.
Where it runs
Application servers run in Dublin. The database and file storage are hosted in AWS eu-west-1, Ireland. Every response carries a content security policy, and browsers are told to use HTTPS only.
Service providers
Services Siteproof relies on.
Who else is involved in running the product, and what each one is used for.
- Clerk
- Sign-in, sessions and organisation membership
- Supabase
- Database and private file storage (Ireland)
- Vercel
- Application hosting (Dublin)
- MapTiler
- Base maps and address search
- Network operator open data
- The published overhead network shown on maps, read only
- Anthropic
- Answers to questions asked of the in-app help assistant
- Resend
- Form submission emails, where switched on
What we do not claim
Not yet, and we will not pretend otherwise.
- Siteproof does not hold SOC 2 or ISO 27001 certification.
- Offline data relies on the device's own encryption rather than a separate Siteproof layer.
- Photo capture times are reported by the device. Siteproof keeps a fingerprint of every evidence photo so you can show it has not changed since upload, but it does not watermark photos or independently verify where they were taken.
- How personal data is handled is set out in the privacy policy. Questions go to hello@siteproof.dev.
Bring your security questions to the demo.
We will show you where each control lives in the product, and answer anything we have not covered here.
Monday to Friday, 9am to 5pm UK time. Database and files hosted in Ireland. No app store needed.