Security and data handling
Separation, minimum data, and disposal at close.
The people most at risk in this work are field workers, not clients. The architecture is built so that a breach of our systems would expose aggregate records and role labels, and not the identity or the location of a person in the field.
Tenancy
One isolated tenant per engagement
- Each engagement runs in its own tenant. No engagement reads another's data, and no shared "all clients" view exists to be misconfigured.
- Row-level security is enforced on every user-exposed table, not only on the ones a reviewer is likely to ask about.
- Cross-tenant reads are zero across the sweep, and the sweep runs on every CI run rather than at audit time.
Zero cross-tenant reads · tested in CI
PII minimum
The field worker is the person we protect
- Field-worker identity, contact details and precise location are confidential, held apart from the evidence store, and never exported to a client.
- Bundles carry a role, never an identity: “field capture role 04”, not a person's name.
- Where a reporter reference is needed for continuity, it is a hashed reference that cannot be reversed from the bundle.
Architecture
Aggregate-only, by construction
The smallest unit the system stores is an aggregate unit. There is no individual-level table to protect, to leak, or to be compelled for, because the schema has nowhere to put one.
- Regimes as configuration
- Per-country data-protection rules are configuration, not code branches: 18 country packs, each encoding retention, export and residency rules for that jurisdiction. Encoded · 1 of 18 verified in production
- What is verified
- Colombia's pack is verified in production. The other packs are encoded and reviewed internally; they are not certified, and we say so rather than imply coverage we have not exercised.
- Retention and disposition
- Retention is set per pack and executed at engagement close: evidence archived to the agreed store, working data disposed of, and the disposition recorded in the custody log.
- Backups
- Nightly database backups and weekly storage copies to separate storage; a restore drill has been run and passes; schedule and scope on request.
- Credential rotation
- Every credential issued for an engagement is rotated at close, and the rotation is logged as a custody event.
Vulnerability disclosure
Tell us, and we will log it
Report a vulnerability to [email protected] with “vulnerability” in the subject. We acknowledge within two working days, keep you informed of the fix, and record the finding in the postmortem set. ⚖ to be confirmed in the security policy We do not pursue researchers who report in good faith.
Subprocessors
Three categories, named in the charter
- Hosting and compute
- Managed database
- Model provider, for extraction assistance only
Each is named, with its region and role, in the engagement charter before signature. No subprocessor receives field-worker identity data.
Request an engagement
Tell us the contest, the date, and the artifact you need. We reply with scope, refusal conditions, and a price against the published floor.