Security
How your facility data is protected
You are putting the operating record of your buildings into somebody else’s software. Here is exactly what protects it, and what we do not yet claim.
The controls
What is in place today
Isolation in the database
Every row carries the company it belongs to, and access rules are enforced by the database itself rather than by application code.
Access by role and scope
What somebody sees is limited to the buildings and clients they are responsible for, on the web and on the phone.
Encrypted in transit
HTTPS everywhere, with strict transport security, and a content security policy on every page.
Scoped API keys
Keys are scoped, revocable and auditable. Webhook deliveries are signed so you can verify they came from us.
Passwords and recovery
Password sign-in with email confirmation and a proper reset flow, on the console and on both phone apps.
An audit trail
Who changed what, and when, kept as a record rather than as a log we might rotate away.
Leaving
You can take everything with you
Full CSV exports and a documented API cover every record: work, runs, evidence, equipment, people and reporting. We would rather earn the renewal than hold the data.
What we do not claim
We do not currently hold a SOC 2 or ISO 27001 certification, and we are not going to imply otherwise with a badge. If your procurement process requires one, tell us early and we will tell you honestly where we are.
What we will do is complete your security questionnaire properly, confirm in writing where your data is stored and who can reach it, and put you in front of the people who built the system rather than a form.
Reporting a problem
If you find a vulnerability, tell us
Write to us with what you found and how to reproduce it. We will confirm receipt, keep you updated while we fix it, and credit you if you would like to be credited.
Questions people ask
- Can one customer see another customer’s data?
- No. Every record carries the company it belongs to, and the rule is enforced in the database, so it applies to the web app, the phone apps and the API equally.
- Do you hold SOC 2 or ISO 27001?
- Not today, and we will not pretend otherwise. Tell us what your procurement needs and we will answer it honestly.
- Can we get our data out?
- Yes, at any time, through CSV export or the API. Everything: work, evidence, equipment and people.
- What happens to photos taken in the field?
- They are held on the phone until they upload, then stored against the step that asked for them, reachable only by people in your company with access to that building.
Ready to see DFM in action?
Book a demo and see the platform running against a building like yours.