Separate sessions
Admins, customers and staff sign in from separate login addresses. The session cookie cannot be read by scripts, is not sent with requests coming from other sites, and on https connections is only sent over the secure channel.
What we protect, how, and where we stand
This page lists the measures that run in the application and the personal data it processes. We also list the topics set by contract; we do not promise anything that is not on this page.
- Three separate loginsAdmin, customer, staff
- One-way password hashNo plain-text passwords are stored
- Company separationYou only see your own data
- Security logEvents are logged with a risk level
Measures that run in the application
All of them run inside the software; you do not need to switch them on for each customer.
Form protection
Forms that change data carry a verification token tied to the session. If the token is missing or wrong, nothing is done.
Passwords
Passwords are stored as a one-way hash; plain-text passwords are not kept.
Login attempt limit
On customer login, repeated failed attempts are temporarily blocked per account and per network address. The demo form is also limited to 5 submissions per hour from the same address.
Two-step verification
On a customer account, a second step can be turned on using a code from an authenticator app; it is in every plan.
Browser security headers
Pages cannot be embedded in other sites. Scripts and fonts load from our own server, and camera and location permission is given only to the QR scan screen.
Security log
Events such as failed logins, attempts that hit the rate limit and report exports are logged with a risk level; the admin can see these records.
Company separation
The customer panel shows only your own company’s staff, checkpoints and records.
Database backup
There is a scheduled task for backups; the default setting keeps the last 30 backups. Frequency and storage location are set at installation.
Which personal data is processed
Personal data is processed to run patrol tracking and to respond to demo requests.
- Staff and patrol records
- Staff name, code and scan times. Location is taken from the device at the moment of a scan or incident report and is written only to that record; location is not tracked outside the scan screen.
- Incident reports
- The description staff write, the photo they attach and the location.
- Demo form
- Full name, company name, email, optional phone and note; the sector and time you choose; the fact that the consent box was ticked. To filter out abuse, the sender’s network address and browser information are also stored.
- This information is used only to contact you about a demo.
Set by contract
The topics below are not promised with figures on this page; they are written into the quote and contract according to your setup.
Included in the quote and contract
- Privacy notice and data processing annexes
- Handling of data access, correction and deletion requests
- Service level (availability rate) and support response times
- Hosting location, backup frequency and retention period
Let us answer your security questions in a call
We answer setup-specific questions during the demo or in writing.