Security
The short version is below. The long version — our full information-security brief — goes to your IT team on request.
Your data lives in the United States, in a database and photo store that only your organization uses. We encrypt it, we log every change, we keep it as long as your records policy says — and we give it back and delete it if you leave.
Dedicated
A single-tenant instance — your database and photo store, shared with no one, on a major U.S. cloud.
Encrypted & audited
TLS in transit, AES-256 at rest, and an append-only audit log of every action.
Respectful
Individual accounts, SSO in production, and crew location captured only while signed in on shift.
We publish our posture plainly — including what we haven't certified yet. The full information-security brief is available to your IT team on request.
Named, not implied
SOC 2 Type II
Not certified today — we won’t print a logo we haven’t earned. If Type II is required to award, the engagement starts in year one as a contract deliverable.
Penetration test
Independent pen test scoped before production go-live; the attestation letter is shared with your team.
Devices & MDM
Customer-owned iPads, supervised via Apple Business Manager and your MDM — Intune or Jamf — before first login. Web app only; nothing side-loaded.
Identity
Production sign-in is SSO (SAML/OIDC) to your IdP, inheriting your MFA. Individual accounts only; support access is logged break-glass.
Data residency
U.S. only — servers, backups, and support. Cloud provider named during security review.
Demo vs production
Demos and pilots run on isolated data. Production is a fresh dedicated instance, provisioned after your questionnaire is green.
With the questionnaire
Architecture
A one-pager: app host, database, photo store, and who connects from where.
Access model
The role list — manager and crew — and exactly what each can do.
Encryption & backup
The written statement: TLS in transit, AES-256 at rest, encrypted U.S. backups.
Retention & exit
Retention options mapped to your records policy; full export and certified deletion on exit.
Subprocessors
Every third party that can touch your data, named before go-live.
In writing
No production data in demos. No AI training on your data. An incident-response contact who answers.