Security and your data

Where SITEKEEPER keeps your sites, photos and reports, who can see them, what is recorded, and how you take all of it with you. Written for the people who review a new supplier: property, IT and procurement.

Database: In Canada (Montréal)
Separation: Each organisation’s data is fenced off by the database itself
Sign-in: Single-use email links, no passwords
Audit: Changes recorded in a log that cannot be altered
Export: Everything, at any time, at no charge

Where your data is held

The SITEKEEPER database is held in Canada: PostgreSQL run by PlanetScale in Amazon Web Services’ Montréal region (ca-central-1). It holds your sites and outlines, ratings, survey records, asset register, quotes, members and audit log.
Files (photos, clipped imagery and reports) are kept in Cloudflare R2 object storage, which does not guarantee a location in Canada.
The website and portal run on Cloudflare’s network, so a request can be handled outside Canada on its way to the database. Database results are not cached along the way.

Each organisation sees only its own data

Every query the application makes is limited to one organisation, and the database checks the same rule a second time with row-level security. Work that spans organisations, such as signing in, has to say so explicitly.
The application’s database account has no administrator rights: it cannot bypass row-level security or change the structure of the database.
Your administrators decide who joins and with which role. Client administrators manage members, sites, assets and sharing, export data and read the audit log; client viewers read, download reports and export.
Avok staff work in client organisations to rate sites and prepare reports. Everything they change is recorded in that organisation’s audit log.

There are no passwords to steal or reuse. You sign in with a link sent to your work email; it works once and expires after 15 minutes.
You stay signed in for up to 30 days after your last visit, or until you sign out.

Every change is recorded

The database records each addition, change and deletion to your sites, ratings, surveys, photos, assets, quotes, reports and members in an audit log: who made it, when, and which fields changed. The log is append-only, so the database refuses any change to it, and your administrators can read it in the portal.
Evidence stays as it was recorded. A signed-off survey observation cannot be changed or deleted, a completed asset inspection keeps its photos and findings, and each photo keeps the fingerprint (SHA-256) it was stored with.

Photos and privacy

Before a photo is uploaded, the person taking it marks any faces and licence plates, and the phone pixelates them. The unblurred photo never leaves the phone.
Location and camera details are removed from the stored photo files.

A guest link shows one site to someone without an account, such as a consultant or a contractor you invite to bid. It lasts at most 90 days, can be revoked at any time and never shows quotes or budgets.
The link’s secret is shown once and only its fingerprint is kept, so it cannot be read back from SITEKEEPER’s database. Shared pages are kept out of search engines.

On the web

HTTPS only, and browsers are told never to connect without it (HSTS).
No advertising, analytics or other third-party scripts. A strict content security policy limits what each page may load; only the optional Google context page loads Google’s map scripts.
Other sites cannot show SITEKEEPER pages inside a frame.

Your data is yours

You own your data, and you can export all of it at any time at no charge: one ZIP file with every record (CSV, GeoJSON, a shapefile and JSON), your photos, the clipped imagery and the PDF reports.
In the ZIP: portfolio.csv, portfolio.geojson and a shapefile with one row per site (area, screening, PCI, indicative budget and latest quote); assets.csv and assets.geojson with the asset register (UNIFORMAT II code, condition, remaining life and recommended work); every record as JSON; and the photos, clipped imagery (GeoTIFF), readings and PDF reports. A README file lists the contents and the imagery licences.
SITEKEEPER takes no revenue from paving contractors.

Services that handle data for SITEKEEPER

These are the outside services involved in running SITEKEEPER, what each receives and where.

Services that handle data for SITEKEEPER
Service	What it does	What it receives
PlanetScale	Runs the database, in Canada (AWS Montréal region).	All records: sites, ratings, surveys, assets, quotes, members, audit log.
Cloudflare	Runs the website and portal, stores files (R2) and sends sign-in and invitation emails.	Requests to the site, files, and the email addresses it sends to.
OpenStreetMap	Street map tiles, loaded by your browser, and address search (Nominatim).	Your browser’s requests for map tiles, and addresses typed into the site search.
Public imagery services	Ontario’s aerial imagery, USDA NAIP and state imagery programmes.	The map area around each site, to clip its imagery.
Google	Maps and Street View on the optional Google context page, and Street View for Avok analysts. No Google image is stored.	Map requests from those pages, for the site’s location.

Certifications and questionnaires

SITEKEEPER does not yet hold a SOC 2 report or an ISO 27001 certificate. This page describes the controls that are in place today. Send us your security questionnaire through the contact page.

Reporting a security problem

If you find a security problem, tell us through the contact page: what you found, where, and how to reproduce it.