Security and your data

Where it lives

Your data is stored in the United Kingdom, encrypted at rest and in transit, and backed up daily with point-in-time recovery.

Isolation between organisations

Every record belongs to one organisation, and the database itself refuses to return or accept a row for any other organisation, whichever screen, export or integration asks. This is enforced with row-level security policies and tested automatically on every change we ship.

Sign-in

• Passwords need at least ten characters. Sign-in is rate-limited.
• Two-step login (an authenticator app) is available to everyone from Account, and required for owners and admins.
• Magic-link sign-in is available for people who prefer not to keep a password.

Who can see what

Roles control the screens people can reach, and the database applies the same rules to the data behind them. An engineer sees only jobs assigned to them. A customer sees only their own company's records.

Audit trail

Changes to customers, jobs, leads and charges are logged with who made them and when. On Premium the log is visible in the app; on every plan it is kept for two years.

Export and deletion

Admins can export customers, sites, jobs and more as CSV at any time (Premium), and you can ask us for a full export of your organisation. When an organisation is deleted, its data is removed within 90 days and from backups within a further 30.

Reporting a concern

Email security@simplisite.co.uk. We acknowledge within one working day.