Security Policy

1. Scope

This policy covers the partner platform - partner and engineer accounts, client and site records, job/quote/invoice data, and anything else your business holds in the partner portal - because this is where your business's own data lives, not just your clients' footage.

Camera footage itself is covered separately on our main Security page: it's recorded and stored on your client's own Hub by default, not in the partner platform.

2. How partner platform data is protected

• •Passwords: stored only as strong one-way hashes (Argon2id) - we never hold a recoverable copy.
• •Two-factor authentication is mandatory for partner portal sign-in.
• •Sensitive fields such as phone numbers, addresses and company numbers are encrypted at rest (AES-256-GCM), and staff access to them is logged.
• •All traffic between the portal, the apps, a Hub, and our servers uses HTTPS.
• •Ownership is checked on every request - a partner can only ever see their own clients, sites and devices; an engineer only the sites they've been assigned.
• •Login and password-reset endpoints are rate-limited, on top of account lockout after repeated failed attempts.

See the Security page for the fuller technical breakdown, including how this sits alongside Hub-level security.

3. Our infrastructure and disaster recovery

We run and control our own hosting for the partner platform, with a monitored standby environment kept in sync with the live system and a tested recovery process, rather than relying on a single point of failure. See our Service Level Agreement for our uptime target and how this fits together.

4. Sub-processors

We use a small number of specialist providers - for storage, payments, DNS and security, hosting and email, and accounting - each bound to obligations at least as strong as ours. The full data processing terms, including how we handle sub-processors, are in our Terms of Use.

5. Reporting a vulnerability

If you believe you've found a security vulnerability anywhere in the partner platform, email [email protected] with what you found and how to reproduce it. We aim to acknowledge reports within 2 working days. See the full policy, including how we handle good-faith research, on the Security page.

6. If something goes wrong

No system is perfectly secure. If a breach affects your personal data, we'll tell you and, where required, the ICO without undue delay - the same commitment set out in our Privacy Policy.

7. Contact

Questions about this policy? Use the contact page or email [email protected].