Security & data residencySecurity & residency
Where your data lives, and who can see it.
The short version for procurement and IT reviews. Send us your security questionnaire and we will answer it.
The short version for procurement and IT reviews.
Residency
Accounts and project database in Canada (Central). Each component and its region is listed below.
Access
Invitation-only projects, role-based access, per-layer permissions, expiring access.
Accountability
Audit log per project; data deleted on request at the end of a contract.
Data residency
Each component, its provider and its region.Component, provider, region.
| Component | Provider | Region |
|---|---|---|
| Accounts & sign-in | Supabase Auth | Canada (Central) |
| Project database | Supabase Postgres | Canada (Central) |
| Web app & APIs | Cloudflare Workers | Global network (requests handled near the user) |
-
Accounts & sign-in
Supabase Auth · Canada (Central)
-
Project database
Supabase Postgres · Canada (Central)
-
Web app & APIs
Cloudflare Workers · Global network
Access model
Three roles, set per project.
Admin
-
Invite and remove
members
-
Set roles, groups
and per-layer access
-
Set access expiry
-
See the audit log
Editor
-
Everything a
Viewer can do
-
Create and edit
features
-
Run exports in the
project template
Viewer
-
Open the project
link
-
Measure and view
layers they’re allowed to see
-
No edits, no
exports unless granted
-
Admin
Invite, set roles and per-layer access, see the audit log.
-
Editor
Create and edit features, run exports.
-
Viewer
Open, measure and view permitted layers.
-
Audit log
Invites, shares, exports and role changes logged.
Practices
How we handle your data.
-
Encryption
TLS in transit; encrypted at rest by our storage providers.
-
Share links
Links never contain account IDs and can expire.
-
Audit log
Invites, role changes, shares and exports are logged per project.
-
Least privilege
Staff open a customer project only when you ask for support.
-
Subprocessors
Published list at /legal/subprocessors, kept current.
-
Responsible disclosure
Report issues to [email protected].
Have a security questionnaire?
Send it to [email protected]. We’ll answer it and point you to our subprocessor list.
