What is true about your data today.
Only controls that are in the product now are listed here.
Where your data lives
- Database in the EU
- Your venue records are stored in a managed PostgreSQL database hosted in Frankfurt, Germany.
- Operators kept apart by the database
- Each operator's records are separated by row-level security in the database itself, in addition to the application in front of it.
Who can see what
- Roles and permissions
- Every user holds a role, and every change is checked against that role's permissions on the server. Template roles are read-only. You clone one to make your own.
- Sensitive areas need their own permission
- Incidents, statutory injury reports, security operations and rates each need a dedicated read permission. A role without it is refused, and counts are withheld rather than shown as zero.
Medical data about injured people
- A permission granted on purpose
- Reading a casualty's identity and clinical notes needs a permission that no template role carries. It must be granted to a named person deliberately.
- A password, re-entered
- Even with that permission, the password must be entered again and verified on the server. The access lasts ten minutes.
- Every look is logged
- Each attempt to open a casualty's identity is recorded in a log that cannot be edited or deleted.
- Erased after one year
- The personal details are erased automatically after one year by a daily scheduled job. The non-identifying safety record is kept.
Records that stay records
- Kept, not deleted
- Incidents, site sign-ins, key issues, patrol logs and work orders cannot be deleted. An entry made in error is corrected or closed with an explanation.
- History written by the database
- Work-order history and permit history are written by the database on every state change, and the work-order history cannot be altered afterwards.
- Who did it comes from the session
- Who raised, reviewed or recorded something is taken from the signed-in session, never from what a form sends.
- Who changed what
- Creates, changes and deletes are recorded with who made them, and listed newest first on an activity screen.
This website
- No trackers, no cookies
- This site sets no cookies and loads no analytics, third-party scripts or third-party fonts. Its own small scripts run the menu and the product replicas, and send nothing anywhere.
Medical data behind its own lock.
Try the step-up on a replica: a dedicated permission, the password again, and a log entry for every look.
INC-2026-00007 · Fall on stairs, east concourse
Medical · Sat 21:05 · Logged by the duty manager
- Casualties
- 1
- Severity
- Minor injury
- Treatment
- First aid on site
- Outcome
- Went home
The clinical picture is what the venue needs for its safety record. It does not identify anyone.
Identity and clinical notes
Locked. Nothing personal has been sent to this page.
Enter your password to continue
The same password you signed in with. It is checked against your account, and the record stays open for ten minutes.
- Name
- Sample Person
- Age
- 34
- Notes
- Sprained left ankle
- Open until
- 21:52
Who opened this record
- No one yet.
Open the record and watch the access logReplica with sample data. The real screen asks for your real password.
Questions from your security team?
Book a demo and bring them. We answer from the product.