Security and data
Readiness records are safety evidence. They must be accurate, available when a regulator asks, and invisible to everyone else. The same controls cover every Escudo product.
Controls
- Data location
- Every record and photo stored in Sydney (ap-southeast-2), for customers in every country we serve. The dashboards run in Sydney.
- Separate databases
- Escudo Emergency, Escudo Fleet, and Escudo Aviation with Escudo Mining each run on their own database with their own dashboard. A commercial fleet never shares a database with an emergency service.
- Separation
- Each customer is its own organisation. Separation is enforced in the database with row level security, not only in the app, so one organisation cannot reach another by any route.
- Proof
- Over 1,100 automated database tests run before each release, including deliberate attempts to read or write across organisations. All are refused.
- Roles
- Four roles per organisation, named in each product’s words. Officers and supervisors with a home station see that station’s alerts.
- Audit log
- Append only. A rule in the database refuses any edit or deletion of an entry, from the dashboard, the app or any other account, including ours.
- Records
- Submitted checks, walkaround photos, meter readings, fuel transactions and published templates cannot be altered after the fact.
- Photo evidence
- Photos come from the live camera only, stamped on the phone with the time, and the GPS position and heading where the phone allows, when the shutter fires.
- Sealed checks
- In Escudo Aviation, and in Escudo Emergency with ARFF on, each submitted check is sealed about an hour after it reaches the server, with a SHA-256 hash chained to the previous check for the same asset. Change a sealed answer and the chain no longer verifies. Corrections are kept as new versions beside the original.
- Proof of presence
- Where a section asks for a tag, the scan, or a skipped scan with its reason, is recorded with the time on the device. GPS is recorded during checks only, never tracked in the background.
- Offline
- Checks, photos, defects and fill-ups wait on the phone and send when signal returns. Every record carries an id made on the phone, so nothing is doubled.
- Internal functions
- The database functions that set status, raise alerts and file readings cannot be called by any user, only by the platform itself.
- Photos
- Private storage, served through short-lived links to that organisation only.
- Sign in
- Email and password, or Microsoft sign-in on the dashboard. Passwords are never stored in plain text.
- Billing
- Escudo Fleet card details are entered on and held by Stripe, our payment provider, and never touch our servers.
- Transport
- HTTPS everywhere, a strict content security policy, no framing.
- Independent review
- An independent security review and penetration test of Escudo Emergency have been completed.
Straight answers
- Can you see our data?
- Only with your permission, to help you with support.
- What if we leave?
- Export everything first, as spreadsheets. We keep your records while your account is open and as long as the law requires, and you can ask us to delete them at any time.
- Do you sell or train on our data?
- No.
- Do you share data with insurers?
- Never without your explicit consent. If you want an insurer or a broker to see a record, you export it and send it yourself.
- Who hosts it?
- Supabase and Vercel, both in Sydney.
- Are you certified?
- We do not claim a certification. We will show your IT and security people the controls and the tests instead.
We are happy to walk your IT or WHS people through the detail, including the tests, before you commit.
Bring your IT questions
We will answer them plainly, and show you the tests rather than a certificate wall.
Or email us: info@escudoready.com