Security and data

SiteProof's database, photo storage and sign-in service run on Supabase, hosted in the United States (Amazon Web Services, US West). The web application runs on Vercel in the United States. Data is encrypted in transit over HTTPS and encrypted at rest by those providers.

• Every company's records are separated inside the database by row-level security. A company's accounts can read only that company's records. Engineering tests this separation against the live database with automated test suites that sign in as separate companies and try to reach each other's records. Those suites run automatically after every release to production, and daily.
• Where two contracting companies work the same property, neither can see the other's jobs, crews, photos, prices or records.
• Inside a company, access follows roles. Admins run the company's account. Operators see only the jobs assigned to them, plus their crew's jobs if they are flagged as a Supervisor. A Property Owner sees service records for its own properties only. Each customer company has one or more branches, created only by SiteProof. Each Admin reaches only the branches ticked for them, by SiteProof or by another Admin of those branches, and works inside one branch at a time. The database itself keeps each branch's data separate, so branch data never mixes.
• Keys that can bypass row-level security exist only on SiteProof's servers. They are never sent to a browser or a phone.
• SiteProof staff reach a customer's account only for support, security, billing and legal reasons. When staff sign in as one of a customer's users to give support, the start and end are recorded in the audit log. These sessions are read-only unless staff choose otherwise, can make no changes after 30 minutes, and return staff to their own account at 30 minutes.

• There is no public sign-up. SiteProof creates each customer company, its branches and its first Admin. Admins add the other Admins for the branches they hold, and the company creates its own operators.
• Admin accounts sign in with an email address and a password.
• Operators sign in with a username (or an email address) and a six-digit PIN or a password, so a crew member does not need a work email or an authenticator app. A company can print a credential sheet for a whole crew when it creates their accounts.
• Repeated wrong attempts at SiteProof's sign-in screen lock the account for 1 minute after 5 failures, 5 minutes after 10, and 30 minutes after 15. An operator's six-digit PIN works only on that screen, so it cannot be guessed around the lockout by calling the underlying sign-in service directly. An Admin can reset an operator's PIN or password, which also clears the lock.
• When SiteProof or an Admin resets an Admin's password, that person is told by email and signed out on every device, and a reset password must be changed at their next sign-in.
• When someone leaves, the company archives their account. They can no longer sign in or be assigned work, and their past work stays on the record. Operator accounts can be restored by the company; an archived Admin can be restored only by SiteProof.
• Every sign-in through SiteProof is logged with the time, the method, and the device's internet address and browser. A password sign-in made directly against the underlying sign-in service, outside SiteProof, is also logged with the time and method, and marked as direct. Every customer user accepts SiteProof's terms before the app opens; operators accept again on each new phone.

SiteProof LLC is one of the Hofund companies: SiteProof LLC, Hofund Inc, and their affiliates. Work records are sent to the Hofund companies' data platform: account, job and property identifiers (random codes, not names, which SiteProof can link back to the records they came from), exact job times, GPS positions recorded during jobs, and task and equipment types. Every GPS position is rounded to two decimal places of latitude and longitude, a grid of roughly one kilometer, before it is sent; the exact positions stay in SiteProof as the customer's own records. Names, email addresses, phone numbers, property names and addresses, photographs, prices and payment details are never sent. The Hofund companies treat these records as confidential internal records and never release them individually.

The Hofund companies may publish or license only grouped figures, and every release must pass a release check that refuses it unless: the figure combines data from at least five unrelated contracting companies; no one company's data makes up more than 30% of it; it is not broken down by anything that identifies a customer, property, account or person; times are coarsened to the day and locations to a grid of about a kilometer; and it does not differ from a figure already released by fewer than five companies, so two releases cannot be compared to isolate one company. Before each new kind of figure is first released, a written assessment considers whether a customer, property or person could still reasonably be identified, for example from a narrow area, a short time window or a small group, and it is not released if so. These thresholds and checks are safeguards that work together; no single threshold guarantees anonymity on its own. No grouped figures have been published or licensed to date. They never sell, license or publish data that names, ranks or singles out any contracting company, never disclose a customer's data to, or use it for the benefit of, that customer's competitors, never sell data that identifies a customer, and never attempt to re-identify anyone. The full terms are in the Company Service Agreement (sections 10 to 12).

A company that pays by card or bank account enters those details into a form provided by Stripe, and Stripe holds them. SiteProof stores only the kind of method, its brand, last four digits, expiry and status. Operators and property owners never see billing.

SiteProof does not hold a SOC 2 report or an ISO 27001 certification, and does not claim to. What we do have is listed on this page: US hosting with encryption, database-level separation between companies, role-based access, sign-in lockout and logging, an audit log, written retention rules enforced on a daily schedule, and the contractual commitments in our published terms.

If a security incident affects a customer's data (including its loss, alteration or destruction, or access to it by anyone not authorized), we tell that customer without undue delay, and in any case within 72 hours of confirming it, with what we know, what we are doing and who to contact. Nothing in this commitment delays any notice the law requires sooner. We keep the customer informed until it is resolved, notify individuals and authorities where the law requires it, and help the customer with any notice it must give.

• Job records, photos and receipts are kept for the life of the company's account. They are the proof of service the product exists to produce.
• Individual GPS positions are deleted once they are 90 days old and the job is closed (completed, cancelled or skipped), or once nothing has been recorded for 90 days on a job left open, after being reduced to a per-job summary that records no route.
• Audit logs are kept 400 days. Device sync records are kept 90 days.
• When a company leaves (for a company that cancels, on the date its service actually ends, which is the end of its last paid license year), its records stay readable for 30 days, during which it can ask for an export of its records and photos. We deliver a requested export within 30 days of the request, and delete nothing before it is delivered, even if that is after the 30 days. If it asks in writing for its records to be deleted, we delete them within 30 days of the request. If it does not ask, we may delete them at any time after those 30 days, other than records in an export still being delivered, and will delete them within 12 months of it leaving. We confirm deletion in writing on request. The hosting provider backs up the database daily and keeps each backup for 7 days, after which it ages out. Photos are not in those database backups; they are copied every night to a separate, private backup held with a different provider, and a photo deleted from SiteProof is removed from that backup 7 days later.
• Records of what each person accepted, and sign-in records, are kept for the life of the account plus 10 years. They protect SiteProof in its relationship with each user and are not used for anything else.

• Supabase: database, file storage and sign-in (United States).
• Vercel: runs the web application (United States).
• Resend: sends email.
• Mapbox: address search and maps.
• Stripe: card and bank payments for contracting companies.
• Open-Meteo: weather, using locations rounded to about a kilometer.
• Hofund companies' data platform: the work records described above, with positions rounded to about a kilometer.
• This list is kept current in the User Terms and Privacy.

Security questions, or to report a concern: contact@siteproof.co.