Security
Your safety records are evidence. Here is how we protect them – stated plainly, without overclaiming.
Hosting and encryption
- Customer data and files are stored in the EU (Ireland) with Supabase, under the UK's adequacy regulations for the EU/EEA.
- Data is encrypted in transit (HTTPS/TLS everywhere) and encrypted at rest by our hosting providers.
- Automated backups are managed by our database provider.
Access and accounts
- Two-factor authentication with an authenticator app is available for owners, admins and managers.
- Passwords must be at least 12 characters with upper-case, lower-case and a number, and are stored hashed by our authentication provider.
- Role-based access: owner, admin, manager and operative. Sensitive modules (for example health surveillance) are limited to owners, admins and named people.
- Sessions end after 7 days without use, and at most after 30 days.
- Operatives sign in with a badge or PIN; PINs are stored hashed and lock after repeated failed attempts.
Keeping customers apart
- Every record belongs to one company and is protected by database row-level security, so one customer can never query another's data.
- Automated tests check isolation between companies.
Records you can trust
- An append-only audit log records who did what and when.
- Version history keeps earlier versions of documents and sign-offs.
- Share links use long random tokens stored hashed; they can expire and be revoked at any time.
Application security
- A strict Content Security Policy and security headers on the app.
- Payments are handled by Stripe, a PCI DSS Level 1 provider. We never see or store full card numbers.
- Error monitoring strips personal data and secret link codes; optional session replay masks all text and inputs.
Certifications
We don't currently hold Cyber Essentials or ISO 27001 certification. We'll update this page if that changes. Our main infrastructure providers publish their own certifications (for example Supabase and Stripe).
Incidents
If a personal data breach affects your data, we'll tell you without undue delay and within 48 hours of becoming aware, as set out in our DPA.
Responsible disclosure
If you think you've found a security problem, please email support@g8-one.com with “Security” in the subject and enough detail for us to reproduce it. Please don't access other people's data, disrupt the service or publish the issue before we've had a reasonable chance to fix it. We'll acknowledge your report within 2 working days and keep you updated.