Security and data protection

Every row of business data belongs to one organization, and the database itself refuses to return another organization’s rows. Postgres row-level security enforces it, independently of the application’s code.

Before any change can be merged, automated tests audit the database schema for isolation, exercise the database’s rules as the service’s own restricted role, call every route of the service as one organization with another organization’s identifiers, and check that every report gives the same answer whether or not another organization’s data exists.

No report, benchmark or analysis reads more than one organization’s data, our own included.

Photos are stored per organization and served only through links that expire within minutes, issued after access has been checked.

A new table or route that the isolation tests do not cover fails the build, and the schema audit is itself shown failing on a table without isolation, so a broken check cannot pass quietly.

Records are never silently overwritten. A correction is stored beside what it replaced, with the account, the device and the time that made it.

No role and no administrative operation, voiding a lot included, removes or alters an existing record.

Every record carries the account that entered it. Crews and devices are unlimited, so nobody needs to share a login.

Where the law requires personal data to be erased, an owner does it in the product, and the erasure itself is recorded.

Console accounts can add codes from an authenticator app, and an owner can require them for every member of the organization.

The device app keeps records, the tree list and photos in encrypted databases (SQLCipher, 256-bit key). Photos never go to the device’s gallery.

Each person unlocks with their own PIN, and the app locks after 30 minutes in the background.

An owner or manager revokes a device from the console. It wipes its data the next time it connects.

The location is taken when a felling is recorded. The app never follows anyone in the background.

The service and its database run in Frankfurt, Germany. Photos and files are stored in the EU, and so are the backups.

The database is backed up every night, encrypted before the backup leaves the service. Restoring from a backup has been tested end to end.

Nobody at Tomruq can read your data unless an owner grants access from the console, for a limited time, and you see every access.

A scheduled copy of your complete history and photos, in storage you control. Today, an owner can download the organization’s complete archive from the console at any time.

Recording in the field does not depend on our service. Devices keep recording during an outage and send what they hold when it is over.

Workers’ national identifiers are masked, left out of exports by default, and every full read is recorded with its reason.

A reviewed data processing agreement with a published list of sub-processors, notice before it changes, and standard contractual clauses for transfers.