Security and your data

What this is for

A short, plain answer to "how safe is our data?" It only says what Tomruq does today. Plans are marked as plans.

Your organization's data stays yours, and separate

Every record belongs to exactly one organization.
Organizations are kept apart inside the database itself, by rules the database enforces on every query. This works independently of the application's own checks, so a mistake in the application does not open one organization's data to another.
Automated tests check this separation on every change to Tomruq, before the change can go out. They check that every table in the database is kept apart by organization, try to read another organization's records through every part of the service, and check that no report changes when another organization's data changes. A new part of the service that these tests do not cover stops the change.
Tomruq never combines organizations' data: no benchmarks, no cross-customer statistics, also not for our own analysis.
Your organization is treated exactly like every other. There are no special cases and no hidden switches.

History is never erased

Records are never silently overwritten. Every change stores who made it, when, on which device, what changed and the value before.
No role, and no administrative action, removes history. Not even deleting a tree record or voiding a lot: those hide records, and the records stay.
Owners, managers and auditors can read the whole history under Activity.
Tomruq provides evidence. It does not certify anything, and it is not an auditor or a guarantee of your compliance.

Who can see what

Four roles decide what each person can do: owner, manager, field user, auditor. Auditors read and change nothing. See Crew and accounts.
A person's role is checked again on every request. A change of role or a suspension takes effect at once.
ID numbers, such as employee numbers, are shown masked. Reading one in full needs a password and a reason, and is recorded. They are left out of exports unless an owner allows it. See Auditor access to ID numbers.
Support cannot look into your organization unless an owner gives access: for at most 72 hours, never with exports or ID numbers, every request recorded, and every owner told by email. See Support access.

Signing in

You sign in with your email address and one password, for every organization you belong to. The organizations are shown only after the password is right, and only your own.
Passwords have at least 12 characters.
Repeated wrong passwords are slowed down.
Two-step sign-in asks for a code from an authenticator app on your device as well as the password. Turn it on under Me → Two-step sign-in. An owner can require it for everyone who uses the console under Settings → Two-step sign-in. Support access always needs it.
A wrong password at an organization's own sign-in page shows in that organization's Activity. A wrong password on the email sign-in page names no organization yet, so it is not shown there. It is slowed down the same way.
Changing or resetting a password signs that person out everywhere.
Big changes, such as making someone an owner or voiding a lot, ask for the password again, so nobody can do them at a computer left unattended.
A browser session ends after 12 hours without use.

On the devices

Records on a device are stored encrypted. The device's PIN unlocks them.
Photos are taken inside the app and stored encrypted. They never go to the device's photo gallery.
Location is taken only while the felling screen is open. The app never tracks anyone in the background, and never uses the microphone.
After 10 wrong PINs, the PIN is removed. The records stay, and only the person's password can open them again.
A lost or stolen device can be revoked in the console. At its next contact it deletes everything it holds.
A device that has been offline too long must connect before it records more (30 days by default).

In transit and on our servers

Everything between devices, browsers and our servers travels encrypted (HTTPS).
Tomruq is hosted in the European Union (Frankfurt), with photos in EU-jurisdiction storage.

Your crew keeps working when we cannot

Crews record on the device without signal, and without our servers. If our service is down, recording goes on, and everything is sent when it is back.

Billing never blocks recording. If an account is unpaid, the office pages are paused; crews keep recording and devices keep sending.

Getting your data out

Any owner, manager or auditor can export a lot's complete workbook or a load's manifest, at any time. See Exports.
Not available yet: a full export of everything your organization holds, and a copy kept automatically in storage you control.

Data protection

Personal data in Tomruq: names of crew and account holders, usernames and email addresses, ID numbers you choose to keep, photos of felled trees, and the location of each felling.
Your organization decides what is recorded and is responsible for it. Ask your organization to correct or remove personal data.
Not available yet: a workflow to erase a person's data on request, which will record that an erasure happened, by whom and why.