Security and privacy
A quality system holds some of the most sensitive information a company has: injuries, near misses, work environment concerns and employee competence records. That places real obligations on us, and they are written out here – with no caveats and no marketing language.
Where the data lives
- All processing and storage happens inside the EEA, with a European provider. The current hosting location is named in the data processing agreement, and does not change without notice.
- No customer data is processed or stored outside the EEA.
- Attachments and photos live in object storage in the same region as the database.
Access and isolation
- Every company is logically isolated. Every row in the database belongs to one organisation, and all queries pass through a shared scoping layer.
- Row Level Security policies exist for every table in the database and are verified automatically, as a second line of defence independent of application code. They are not yet active in production – the application still connects with a role that is not subject to them.
- Five roles with clear scoping, plus a dedicated auditor role with read access and no write rights.
- All access checks run server-side. Hiding a button in the interface is never the security mechanism.
- Attachments live under the organisation’s own prefix and are served only through a route that checks both that the file belongs to your organisation and that you have access to it. Guessing a file key gets you nothing.
Encryption
- All traffic over TLS 1.2 or newer, with HSTS.
- The session token on mobile is held in the device keychain, not in ordinary storage.
- Passwords stored as bcrypt hashes with cost 12. We cannot see your password.
- API keys stored only as hashes. Plaintext is shown once at creation.
Traceability
- Every change is written to an immutable event log: who, what, when and from which IP.
- The log cannot be edited or deleted from the interface – it is the audit trail an ISO auditor requires.
- Sessions are server-side and can be revoked immediately on suspicion of misuse.
Privacy and GDPR
- A data processing agreement ready to sign, including a list of sub-processors.
- Retention rules can be set per object type so you can meet your own deletion deadlines.
- Anonymous deviation reports are stored with no link to a person – the identity does not exist, not on the device and not in the log.
- You own your data and can export everything yourself. Nothing is deleted on termination unless you ask.
- Access, rectification and erasure of personal data can be carried out by an administrator in the system.
What we commit to in the agreement
The points above describe what the software does. The points below are operational undertakings that live in the agreement, not in the code. We keep them apart because the difference matters when IT assesses us.
- All processing and storage inside the EEA, with a European provider. The current hosting location is named in the data processing agreement and does not change without notice.
- A data processing agreement listing our sub-processors, signed together with the subscription.
- Daily backups with point-in-time recovery. Restores are to be exercised and logged, not merely configured.
- Monitoring and alerting on availability and error rates.
- Dependency vulnerability scanning on every build. A critical advisory stops the deployment.
- On termination nothing is deleted: the data stays read-only until you ask for deletion, and you can export everything at any time.
Security and operations
- Data stored inside the EEA, with a European provider
- Data processing agreement signed with the subscription
- Role-based access and a complete audit trail
- All traffic encrypted with TLS 1.2 or later, with HSTS
- You own your data and can export it yourself
- Built for GDPR, with retention rules per object type
Questions from your IT department? Email post@samsvara.no and we will send the data processing agreement, the list of sub-processors and our own supply chain risk assessment.
Try it on your own company
Register your company and pick your industry, and the system is filled with routines, checklists and an annual plan for your industry – in ten minutes. 30 days free, with no card details and no commitment. Would you rather be shown around first? Book a free demo.