Security and data protection

You are trusting us with your quality system. Here is, plainly, where it lives and how it is protected.

Where your data lives

Your records and files are stored in a managed PostgreSQL database and file store run by Supabase, in the European Union (Ireland).
The application is served by Netlify. Data travels encrypted (HTTPS) between your browser, the application and the database.
Every service that handles your data, and the region it runs in, is listed in our privacy notice.

Each organisation is kept separate

Every table holding your data is protected by database row-level security: a signed-in user can only reach the organisations they belong to.
Files are stored under your organisation's own folder, and the same membership check applies to them.
Our build checks reject any new table that ships without these protections.

Who can see and change what

Multi-factor sign-in is required before anyone can read or change your quality data.
Access follows roles (owner, admin, quality manager, regulatory affairs, member, auditor, viewer), so people only change what their job needs.
Approvals use separation of duties: the person who wrote a document or fix does not sign it off.
Auditors get a time-limited, read-only link instead of an account. You can revoke it at any time, and every view is logged.

A record that cannot be quietly rewritten

Changes to your records are written to an audit log in which each entry is hash-chained (SHA-256) to the one before.
Any edit, deletion or reordering of past entries breaks the chain, and the auditor room recomputes and shows the result live.

AI features

Gap analysis, document reading and procedure drafting send the relevant text to Anthropic's Claude API for processing.
Anthropic does not train its models on data sent through its commercial API.
AI output is always a draft or a suggestion: a person in your organisation reviews and approves it before it counts as evidence.

What we do not claim

We do not hold our own SOC 2 or ISO 27001 certification yet. The platform's automated IT controls are evidenced daily and mapped to both, and auditors can see them in the inspection room.
Using the platform does not certify you or replace your regulator or certification body.

The full list of services that process your data, and your rights, is in our privacy notice. Live service status is on the status page. Need a security questionnaire completed? Send it to us.