How we protect your asset data

Isolation

Every record you create is tied to your account and your organization. Our database enforces row-level security policies that check the identity of the requesting user on every single query. In practice, this means one customer's data cannot be read or modified by another customer — the separation is enforced by the database itself, not just by the application.

Encryption

All traffic between your device and our service runs over HTTPS with TLS encryption, so data moving across the network is encrypted. Data stored in our database is encrypted at rest by our infrastructure provider. Photographs you capture are stored in access-controlled storage and served through expiring, signed links rather than public URLs.

Authentication

Authentication is managed by Clerk, a specialized identity platform. We do not store your password. Sign-in uses email verification codes, and your session is secured with industry-standard tokens. This keeps credential handling in the hands of a provider focused on authentication security.

Infrastructure

The application runs on Vercel, and data is stored in Supabase (managed PostgreSQL). Both are widely used, established cloud platforms with their own security programs and physical data-center protections. We rely on their hardened infrastructure rather than self-managed servers.

Subprocessors

Nameplate photographs and the equipment details you capture are sent to Anthropic for AI identification. Under Anthropic's commercial API terms, your prompts and the model's responses are not retained after the response is returned for the models we use, and retained data is never used to train models without express permission. Content flagged by Anthropic's automated trust and safety systems may be held for up to two years. Documentation and parts lookups send only the manufacturer and model — never your photographs. Identity is handled by Clerk, database and photo storage by Supabase, hosting by Vercel, error monitoring by Sentry, and transactional email by Resend. We can provide the full subprocessor list, with the purpose of each, on request.

Access

The equipment data and photos you submit are used to provide the asset-management features you see in the app. We do not sell your data. Access to production systems is limited to what is necessary to operate and support the service.

Your control

You choose which assets, sites, and details to record. You can export your data to spreadsheets at any time, so your records are never locked in. You can archive or permanently delete assets yourself from the register, and if you need an entire account removed, contact us and we will assist.