Security and data protection
Written for the person in your organisation who has to sign this off. It states plainly what is in place today and what is not yet done.
In place today
Access
- Multi-factor authentication is mandatory for every live organisation. Staff cannot reach any case data until enrolment is complete.
- Time-based one-time codes with single-use backup codes
- Passwords hashed with scrypt and a per-password salt
- Accounts lock after five failed attempts; sign-in is rate limited per address
- Sessions expire, time out when idle, and are revoked everywhere on password change
- Role-based permissions — a technician can record an inspection but cannot instruct a repair or export a case
Data
- Encrypted in transit, with HSTS enforced
- Photographs and documents encrypted at rest with AES-256-GCM; plaintext never touches the disk
- Every file integrity-checked against its own hash on retrieval
- Uploads validated by inspecting the file's actual bytes, not its name
- Authenticator secrets stored encrypted, never in plain text
- Session and access tokens stored only as keyed hashes, so a database copy yields nothing usable
- Tenant personal data is never written to application logs
Separation and integrity
- Every query is scoped to a single organisation; cross-organisation access returns "not found", and automated tests prove it
- Case history is append-only at database level — edits and deletions are refused
- Each history entry is hashed with the one before it, so alteration is detectable even by someone with database access
- Sign-ins, exports, permission changes and password changes are written to a separately hash-chained audit log
Application
- Content-Security-Policy with no inline scripts or styles permitted
- Clickjacking, MIME-sniffing and referrer protections applied
- Server-rendered HTML with no client-side framework and no build step, so what runs is what is in the source
- Eight direct dependencies, all pure JavaScript. Authentication, encryption and evidence handling use the language runtime's own cryptography rather than third-party code
- No third-party trackers, analytics, advertising or fonts — on this website or in the product
Data protection
Roles
Your organisation is the data controller. DampFix Scotland acts as your data processor, under a written data processing agreement, and only on your instructions.
Special category data
Reports may include health information and details of vulnerable occupants. That is treated as special category personal data. It is recorded so a household is not left at the back of a queue — and deliberately does not drive any automatic decision that cannot be verified. A named person always reviews it.
Retention
Retention is configured per organisation, defaulting to seven years after a case closes so that a recurrence can be linked to its history. You set the period that matches your own policy.
Information rights
Subject access, rectification and erasure requests are supported by procedure. Because the case history is append-only, erasure is handled by redacting personal content while preserving the integrity chain — so a right is honoured without destroying the evidential value of the record for other parties.
Not yet done — stated plainly
Any supplier who tells you everything is finished is telling you something else too. This is the current position.
| Item | Status |
|---|---|
| Independent penetration test | Not yet carried out. Planned before any live tenant data. |
| Cyber Essentials certification | Not yet held. Identified as a milestone. |
| Independent accessibility audit | Not yet carried out. |
| Data protection impact assessment | To be completed with the first pilot organisation. |
| Production hosting and tested restore | To be provisioned. UK-based managed infrastructure. |
| Legal review of the deadline rules | The timescales are confirmed against the instrument; solicitor review is outstanding before any customer relies on them. |
| Live deployment with a customer | None. Founding pilot places are open. |
A safety rail you can verify
The software refuses to accept a live tenant report from any organisation that is not flagged as a demonstration until production controls are explicitly switched on. That is enforced in the code, not by a promise to be careful. Demonstration environments are labelled on every screen and contain entirely fictional data.
Send us your security questionnaire
If your organisation has a supplier assurance process, send it over. Questions that cannot yet be answered "yes" will be answered honestly rather than creatively.