How we keep your data safe

What we have built in. This is a description of the product, not a certification.

• Separation between organisations: every table is protected by row-level security so one organisation cannot read another's records. This is tested.
• No passwords: sign-in is by emailed link.
• Private photos: stored in a private bucket, shown through short-lived links, checked by their contents (not their file name), and stripped of location data in your browser first.
• Records that cannot be quietly changed: adopted procedures are versioned and fingerprinted; the audit log, scope assessments and decisions cannot be edited or deleted.
• Staff links: private, unguessable, rate-limited, and handled only on our server. Quiz scores are worked out on the server so they cannot be forged.
• Calendar and QR links: unguessable and can be switched off or renewed at any time.
• Browser protections: strict content-security rules, no framing, HTTPS only.
• Your data is yours: download it all at any time.

Found a problem? Please email hello@usesmallprint.co.uk and we will respond promptly.