Security, privacy and hosting

A short page for the organization's IT and legal desks. What is built today, and what is not.

Keeping organizations apart

Each organization has its own data, and the separation is enforced at the database layer by permission controls tied to the user's membership and role, with a second check above it in the application. Permissions are per operation: being on one side of a request is necessary, not sufficient.

The audit trail

Administrative changes are recorded: who changed it, what it was, what it became, when, and from which device and address. It is readable by whoever holds the permission inside their own organization, and it exports.

Attachments

Files are not served from public URLs. Every open goes through a short-lived signed link issued to someone who can already read the request, and it expires on its own.

The rep's location

Optional, started by the rep, broadcast only while they are on the road, and not stored once the trip ends. There is no continuous tracking of individuals and no route history to go back to.

Hosting and data transfer

The platform runs on managed cloud infrastructure and traffic is encrypted in transit. The hosting region, and whether data may leave the Kingdom, is settled in writing with the organization before go-live — we do not present it here as settled.

What we do not claim

There is no certification and no independent security audit of this platform to date, and we do not say anyone has reviewed it from the outside. The above describes what is built, and it is open to review by your own team or a third party you choose before go-live.