Security
What we can show you, not what we can claim
Mechanisms that exist in the product today. No badges we have not earned.
How the platform is built
Eight things we would want to check ourselves
Tenant isolation
Derived from the session on the server, never from a header or a body.
A role check on every route
Every route names who may call it. A route with neither does not ship.
Two-factor for admin accounts
A password and a one-time code at every login. No remembered device.
Secrets stay server side
Session cookies are HTTP-only. For the realtime socket handshake the dashboard does hand the browser the same short-lived access token it uses to call the API, so that token is reachable from page scripts for as long as it lives.
Append-only audit log
Written with the actor and the time. There is no update or delete endpoint.
Photos never pass through the API
Straight to storage on a signed URL, encrypted at rest, EXIF stripped.
Rate limits and account lockout
Sign in, code entry and public reporting are rate limited, with account lockout.
Location only while working
Only while clocked on, expiring within minutes. No background tracking.
Where it runs
AWS in London, with Supabase for the database
Our infrastructure is defined in Terraform and deploys to the AWS London region, eu-west-2, unless a customer contract calls for somewhere else. The application runs on ECS behind a load balancer, with managed Redis and an object store for photos and generated reports. Our PostgreSQL database is hosted by Supabase rather than on AWS, so ask us for its region if that matters to your assessment.
If your procurement team needs the specifics, ask for the security pack. It covers the hosting model and the sub-processors we rely on. We would rather answer a hard question than publish a soft claim.
What we do not claim
- We hold no SOC 2 report and no ISO 27001 certificate. If we ever do, this page will say so with a date on it.
- We do not publish cryptographic details as a selling point. They describe an implementation, not a promise, and they change.
- We do not claim a customer we do not have. There are no logos on this site for that reason.
Your data
Export it, erase it, or let it expire
UK GDPR gives the people in your reports rights over their data. Those rights are features in the product rather than a support ticket you have to raise with us.
Workspace export
The whole workspace as JSON and CSV, through a short-lived link.
Erase an individual
Personal data is scrubbed in place. The operational record survives.
Retention that expires on its own
Photo retention runs to the window on your plan and then purges. A closed workspace keeps its data for thirty days and is then anonymised, and export archives expire rather than sitting on a bucket forever.
No third-party trackers in the reporter
No analytics and no advertising scripts on the public reporting page.
The detail of what we collect and why lives in the privacy policy.
Report a vulnerability
If you believe you have found a security problem in EvoPoint, tell us before you tell anyone else and we will work it with you. Write to security@evopoint.uk.
Request our PGP public keyDoing supplier due diligence?
Send us the questionnaire. We will answer it in writing, and we will tell you where the answer is no.