Security & data protection

What we can tell you about where your data lives, who can reach it, and how long we keep it — written for the people who have to sign this off.

Where your data lives

QuickInspect runs entirely on Google Cloud in the European Union. No production data is processed outside the EU.

Application data and Cloud Functions run in europe-west3 (Frankfurt); a small number of services run in europe-west1 (Belgium).
Data is encrypted in transit and at rest by the underlying Google Cloud infrastructure.
A data processing agreement under Art. 28 GDPR is available on request before you start.

Access is enforced server-side by database security rules, not by hiding things in the interface.

Roles govern who may create, edit, approve and administer; company, project, department and contractor scope govern what they see.
Two-factor authentication can be required for all users, for Key Users, or for administrators only, with a configurable grace period.
Single sign-on with Microsoft Entra ID routes your users to your own tenant; sign-in never touches a shared endpoint.
User provisioning and de-provisioning is available over SCIM, so leavers lose access from your directory.

Retention is deliberate rather than indefinite — different classes of record are kept for different periods.

Privileged events — role, configuration, billing and identity changes — are retained for 730 days.
Operational audit entries are retained for 90 days; AI usage logs for 30 days.
Payment transaction records are never auto-deleted, for PCI DSS purposes.

AI features run in the EU and never take an action on their own.

Model calls run in europe-west1 through a Google service account — no third-party AI API keys are involved.
Every AI output is a draft or a suggestion. An AI-drafted permit cannot change status until a person approves it, and that is enforced by the database rules rather than by policy.
The legal-register assistant only ever proposes entries; it never writes to your register.

The third parties that process data on our behalf. Ask us for the current list with contract details before you sign.

Google Cloud / Firebase — hosting, database, authentication, serverless functions (EU regions).
Google Gemini — the AI features described above (EU region).
Stripe — payment processing for web subscriptions.
RevenueCat — subscription handling for the mobile apps.
Agora — video calls when the HSE assistant escalates to a human expert. Sentry — error monitoring.

Send us the questionnaire. You will get answers from the person who built the system, not a form letter.

This page is maintained by hand and reviewed whenever the underlying infrastructure changes.