Evidence is only worth something if it can be trusted.

What protects your records

• Each business's records are separate

  Every table is protected by row-level security in the database itself, not just in the app. We test automatically that one company cannot read another's jobs, photos, reports or people, and that staff see only the jobs assigned to them.

• Evidence you can stand behind

  Every photo's original is kept untouched, with a SHA-256 fingerprint computed on the server when it arrives. Reports are built from accepted evidence only, and each published version is frozen.

• Client links are unguessable and revocable

  A report link carries a 256-bit random token. We store only a hash of it, so even we cannot reconstruct a link. Links can expire, be regenerated or be revoked, and report pages are kept out of search engines and never cached.

• Private storage

  Photos live in private storage buckets and are shown through short-lived signed addresses, never public URLs.

• A record of who did what

  Job status changes, assignments, approvals, evidence reviews and deletions are written to an audit log that owners and admins can read. Opening an original photo is logged too.

• Deletion is deliberate

  Evidence is not deleted automatically. A person asks to delete a photo with a reason and an owner or admin decides. Erasing removes the stored files while keeping the record, its fingerprint and the audit trail.

• Hardened by default

  The site is served over HTTPS with HSTS, refuses to be framed, rate-limits sign-in and public endpoints, and keeps secrets out of the source code (an automated scan fails the build if one appears).

• Payments stay with Stripe

  Plan payments are handled on Stripe's hosted checkout. ProofTrail never sees or stores card numbers.

What we do not claim yet

• –We hold no security certification (such as SOC 2 or ISO 27001) today, and we will not claim one until we do.
• –Two-factor sign-in is not available yet. Sign-in uses an emailed code or a password.
• –A photo's timestamp and location come from the device and are not proof on their own. ProofTrail shows them and how far a position is from the property; it does not certify them.
• –A proof report is a record of the evidence your team captured. It is not legal advice or an independent inspection.

If you find a security problem, please tell us before telling anyone else. We will treat it as urgent.