Security and privacy
A quality system holds some of the most sensitive information a company has: injuries, near misses, work environment concerns and employee competence records. That places real obligations on us, and they are written out here – with no caveats and no marketing language.
Where the data lives
- All data is stored in Norway with a Norwegian hosting provider.
- Backups are stored inside the EEA, encrypted.
- No data is processed or stored outside the EEA.
- Attachments and photos live in object storage in the same region as the database.
Access and isolation
- Every company is logically isolated. Every row in the database belongs to one organisation, and all queries pass through a shared scoping layer.
- In production, database Row Level Security is enabled as a second line of defence, independent of application code.
- Five roles with clear scoping, plus a dedicated auditor role with read access and no write rights.
- All access checks run server-side. Hiding a button in the interface is never the security mechanism.
- Files are served only through signed, time-limited links issued after an access check.
Encryption
- All traffic over TLS 1.2 or newer, with HSTS.
- Data encrypted at rest at the storage layer.
- The local database on mobile is encrypted on the device.
- Passwords stored as bcrypt hashes with cost 12. We cannot see your password.
- API keys stored only as hashes. Plaintext is shown once at creation.
Traceability
- Every change is written to an immutable event log: who, what, when and from which IP.
- The log cannot be edited or deleted from the interface – it is the audit trail an ISO auditor requires.
- Sessions are server-side and can be revoked immediately on suspicion of misuse.
Privacy and GDPR
- A data processing agreement ready to sign, including a list of sub-processors.
- Retention rules can be set per object type so you can meet your own deletion deadlines.
- Anonymous deviation reports are stored with no link to a person – the identity does not exist, not on the device and not in the log.
- You own your data, can export everything yourself, and on termination data is deleted after the agreed period.
- Access, rectification and erasure of personal data can be carried out by an administrator in the system.
Operations
- Automatic daily backups with restore testing.
- Round-the-clock monitoring and alerting on availability and error rates.
- Updates roll out with no downtime.
- Dependency vulnerability scanning on every build.
Security and operations
- Data stored in Norway, backups in the EEA
- Data processing agreement signed with the subscription
- Role-based access and a complete audit trail
- Encrypted in transit, and at rest with the hosting provider
- You own your data and can export it yourself
- Built for GDPR, with retention rules per object type
Questions from your IT department? Email hei@samsvara.no and we will send the data processing agreement, the list of sub-processors and our own supply chain risk assessment.
Try it on your own company
Ask for the trial, choose your industry, and see how the system looks with routines, checklists and an annual plan already in place. 60 days, no commitment, and no credit card.