Faisal · last updated 12 September 2026
We do not use advertising trackers or third-party analytics. The product loads no third-party scripts.
On servers we rent, in one location. Your files and records are stored there, not handed to a third-party storage service.
Data is encrypted in transit using HTTPS. It is not separately encrypted at rest on the server disk. We say so plainly rather than implying more than is true. Off-site backups are encrypted before they leave the server.
Your own staff accounts, and the client reviewers you invite — and a reviewer only ever sees the single project they were invited to. One customer cannot reach another customer's projects, files or records.
Our staff can access your data only where needed to operate the service or to answer a support request from you.
We do not sell your data and we do not share it for marketing.
The product sends no email. It has no email capability. Every invitation link and password reset link is copied by you and sent through your own email, which means we never hold your clients' addresses in a mail system.
We never see or store your card. Payment is handled by a payment provider, and we keep only which plan you are on, whether it is active, and the provider's reference for your subscription.
Your content is kept while your account exists, and after cancellation so that you can still export it.
If you ask us to delete your organisation, we delete it from the live system — every record and every uploaded file. Backups taken before that point still contain your data until those backups expire in the normal rotation. We tell you the expiry date when you ask for deletion. Sign-in attempt records are removed automatically after 24 hours.
Passwords are hashed with scrypt. Sessions are server-side records, not tokens you carry. Invitation and reset tokens are stored only as SHA-256 hashes. Uploads are checked against their actual file type. Repeated failed sign-ins lock an address temporarily.
The service has not had an independent security audit. We would rather tell you that than imply a certification we do not hold.