Trust and security

Where your data lives

All application data is stored in a Supabase Postgres database hosted in the European Union, in the eu-west-1 region (Ireland). Photo uploads are stored in Supabase Storage in the same region. Data is not replicated outside the EU.

How organisations are separated

Every organisation's data carries an organisation identifier, and separation is enforced in two places:

• Row-level security in the database. Postgres row-level security is enabled on every table that holds customer data, including issues, locations, members, invitations and label records. A signed-in user's queries can only return rows belonging to an organisation they are a member of.
• Organisation scoping in the API. People who report a fault do not have accounts, so those writes are made by the server rather than the browser. Those server paths run with elevated database rights and are scoped to the correct organisation in application code.

We describe both because only the first is enforced by the database. Saying “database-enforced isolation” on its own would overstate it.

Encryption

All traffic to ScanSolve is served over HTTPS, with HTTP Strict Transport Security set. Data is encrypted at rest by our database and storage provider. Photo uploads are never in a public bucket: each is served through a signed link that expires after seven days, and the dashboard requests a fresh link when one is close to expiry.

Signing in

Managers sign in with a magic link or a one-time code sent to their email address. There are no passwords, so there is no password database to steal. People reporting a fault never sign in at all: they scan a code, submit a form, and can leave an email address if they want an update.

What we collect from reporters

A fault report contains the category, an optional description, an optional photo, and an optional contact email. We also record a timestamp and basic request details for abuse prevention. We do not track reporters across sites, and we do not use analytics cookies anywhere on the service.

Application security

• A content security policy and the standard security headers are set on every response, including frame protection, MIME-type protection, referrer and permissions policies.
• Public endpoints are rate limited to slow abuse and automated submissions.
• Card details are handled by Stripe. They never reach our servers and we cannot see them.
• The codebase has had a security audit; the findings were fixed and the work is recorded in our repository history.

Who else processes your data

We do not sell your data and we do not use it to train AI models. A data processing agreement is available to organisation account holders on request.

Getting your data out, or deleted

Issue data can be exported as CSV from the Insights page. If you want your organisation and everything in it deleted, email us and we will do it and confirm when it is done. There is no retention period we hold you to.

Reporting a security problem

If you find a vulnerability, email support@scansolve.co with enough detail to reproduce it. We will acknowledge it within two working days and tell you what we are doing about it. We will not take legal action against anyone who reports a problem in good faith and gives us a chance to fix it before disclosing it.