Security and your data

How we look after your data

Where your data is

All three apps keep their records in Google Cloud (Firebase) in Sydney, Australia: prestarts, Take 5s, checklists, shift logs, permits, isolation photos and accounts. The website itself is served from Google’s global network.

Data is encrypted in transit (HTTPS only) and at rest (Google-managed encryption).

Emails are sent through Microsoft 365. Text messages from Isolations go through ClickSend. Payments are handled by Stripe on the website and by Apple or Google in the phone apps; we never see card numbers.

Backups

Every database is backed up automatically every night. Daily backups are kept for 8 weeks (Forms) or 4 weeks (Shift Log and Isolations), and a weekly backup is kept for 14 weeks in all three. On top of that, point-in-time recovery lets us restore any database to how it was at any minute in the last 7 days.

You can download everything in your account at any time: in Forms, Settings → Download all your records (PDFs and spreadsheets in one ZIP); in Isolations, the site’s Data tab.

Signing in

One Site Safe account signs in to every app. On the website you can sign in with Google or Microsoft, so your company’s own sign-in rules apply — including two-step verification and conditional access set in Microsoft 365 or Google Workspace.

We never see or store passwords: email-and-password accounts are held by Google’s sign-in service as a secure hash.

Operators doing a prestart from a vehicle’s QR code don’t need an account at all, so there are no shared logins on site.

Who can see what

Each app manages its own people. In Forms a company has Owner, Admin, Editor and View-only roles. In Isolations each site sets its own roles, and nobody can act on a permit until a site admin has checked their swipe card.

Access is enforced on our servers by database security rules, not just hidden in the app. Isolations goes further: the app can’t write to the database at all — every permit action goes through server code that checks the person’s role and the isolation rules first.

A vehicle’s prestart history is visible to its owner’s team and to people who have actually used the vehicle. Take 5 reports to a company never include names.

Abuse and misuse

Server functions and public forms are rate-limited per person and per company (sign-ups, emails, swipe-card checks, photo uploads, enquiries and more), so one account can’t flood the system or anyone’s inbox.

Everything shown on screen is escaped against script injection, and an automated check blocks any release that would show unescaped text.

Records can’t be edited after they’re submitted. Repairs, tag-outs, permit steps and admin changes are recorded with who did them and when.

How we build and release

Every change runs an automated test suite before it can go live: unit tests, and end-to-end tests against an emulated copy of the database and server code, including deliberate attempts to break the security rules.

Releases are deployed by our build system with short-lived credentials, not stored keys. Secrets live in Google Secret Manager, never in code.

We’re alerted when server code logs an error or a scheduled job stops running. Live status: site-safe.com.au/status.

Services we use

Google Cloud and Firebase (hosting, database, sign-in, server code), Microsoft 365 (email), Stripe (website payments), Apple and Google through RevenueCat (phone app purchases), ClickSend (Isolations text messages).

Anthropic (Claude) reads a photo of a paper form only when you choose Make a template from a photo and agree to it first. The photo is used to build the template and isn’t kept by us.

What we don’t have yet

Site Safe is made by a small Australian business. We don’t yet hold ISO 27001 or SOC 2 certification and haven’t had an independent penetration test. If your procurement team has a security questionnaire, send it to us and we’ll answer it straight.

Questions or a security concern

Email admin@site-safe.com.au. If you think you’ve found a security problem, please tell us there first and give us a chance to fix it before telling anyone else. We acknowledge security reports within 12 hours, tell you what we’re doing about it, and let you know when it’s fixed. We won’t take action against anyone who reports a problem in good faith and doesn’t access or change other people’s data.

Last checked 16 October 2026. See also the privacy policy and terms.