If you are putting an OnSite Data report into a compliance file, your risk team will want to know how the data is handled. Everything below is current as at the date shown, including the parts that are still work in progress.
Last reviewed 28 September 2026
Photographs, metadata and generated reports are stored and processed in Australia.
StorageSydney, Australia. Database and file storage run on Supabase in ap-southeast-2. Photographs and reports never leave the region.
ProcessingSydney, Australia. Application code executes on Vercel in syd1. Report generation, hashing and every API request run in-region.
EncryptionTLS 1.2 or higher in transit. Encrypted at rest by the storage provider.
BackupsDaily automated database backups, retained for seven days.
DatabasePostgreSQL 17.
Separation between organisations is enforced by the database itself, not only by application code — so a bug in a route cannot expose another organisation’s jobs.
Tenant isolationRow-level security is enabled on every table. Policies scope each row to the organisation that owns it. Tables with no policy deny all access by default.
Admin accessOne person — the founder — holds production credentials. There are no other operators, contractors or support staff with access to customer data.
Team permissionsWithin an organisation, owners manage members and billing. Members create and review jobs. Removing a member requires owner approval.
The person onsiteNever creates an account and never sees your dashboard. They receive a single-use, time-limited link giving access to one submission form and nothing else.
The point of the report is that it can be checked later by someone who does not trust you or us.
File integrityA SHA-256 hash is computed from each stored photo and printed in the report. Recomputing it from the downloaded file returns the same value, or the file has changed.
Stored filesThe ZIP download serves the stored photos, which are the files the report hashes were taken from. Those photos are resized to a JPEG before they are stored. A further compression is applied only to the images embedded in the PDF.
Location and timeRead from the phone when each photograph comes back to the page, alongside the distance to the stated address. Not taken from the image file.
DeterministicFlags and checks are produced by fixed rules. No language model or automated judgement is involved in what appears on a filed report.
Audit trailEvery send, open, submission, review and approval is timestamped and retained against the job, including the reviewing user.
These providers process data on our behalf to deliver the service. Everything else stays in Australia.
Provider
Purpose
Region
Supabase
Database, file storage, backups
Australia · Sydney
Vercel
Application hosting and compute
Australia · Sydney
Kudosity
SMS delivery of verification links
Australia
Resend
Transactional email
Overseas
Stripe
Card payments and invoicing
Overseas
proxycheck.io
Network and anonymiser checks on submitting devices
Overseas — addresses are not retained by the provider
Google Maps
Address lookup and geocoding
Overseas
A security page that only lists strengths is not much use to someone assessing risk. These are the current gaps.
Photographs are deleted automatically 60 days after the job's retention period ends. Photos from jobs that aren't approved are deleted 60 days after the link closes. The remaining record is de-identified seven years after approval. A legal hold pauses deletion until it is cleared.
No SOC 2 or ISO 27001 certification. Neither has been audited. The controls described above are real, but no third party has verified them.
Single operator. OnSite Data is built and run by one person. There is no separation of duties between development and production deployment, and no 24-hour support rotation.
Backups are daily, not continuous. A database failure could lose up to 24 hours of data. Point-in-time recovery is available from our provider and will be enabled as volume grows.
If you believe you have found a security issue, email hello@onsitedata.com.au with the details. Reports are read by the founder directly. Please do not publish the issue before it has been addressed.
Need this in writing?
If your risk team needs a completed vendor questionnaire, ask and we will return it.