Security

Encrypted connections everywhere

Every connection to WhatOnSite — in the browser, on mobile, and to our API — runs over HTTPS/TLS. Your building data is encrypted in transit, always.

Secure authentication

Sign-in is handled by Supabase Auth, a dedicated authentication service. We never store your password in plain text, and sessions are protected against common attacks by design.

Role-based permissions

Every person on your team — Owner, Manager, Maintenance, Contractor, Surveyor, or Viewer — sees only what their role allows. Access can be scoped down to individual sections of a building.

Owner-controlled access

The building owner decides who's invited, what they can see, and when access is revoked. Nothing about who can view your building is decided by WhatOnSite.

Customer-owned cloud storage

Prefer to keep files in your own storage account? WhatOnSite supports connecting your own cloud storage provider, so sensitive files can live under your own infrastructure controls.

Enterprise private cloud

Enterprise customers can run WhatOnSite against fully private infrastructure, keeping every file and record inside environments your own security team controls.

Regular backups

Where hosted on our infrastructure, your data is backed up regularly, so accidental loss on our end isn't a risk to the permanent record you're building.

Data isolation between organisations

Every organisation's data is isolated at the database level — row-level security policies enforce that one customer's buildings are never visible to another, no matter what.

AI security

The AI Assistant only ever accesses information the requesting user already has permission to view, and never trains public models on your data. Full detail on our AI Policy page.