Security & Data

01Encryption

All traffic runs over TLS 1.2 or higher with modern cipher suites; HTTP is redirected to HTTPS and HSTS is enabled. Data at rest, including uploaded photographs and generated PDFs, is encrypted by our hosting providers.

02Tenant isolation

RMS Automation is multi-tenant. Every record carries an organisation identifier, and every query is scoped to the organisation of the authenticated caller at the data-access layer rather than in individual handlers. Uploaded files are served through an authenticated, organisation-scoped route (never from a public directory) and requests for another organisation's file are rejected before the file is read.

03Authentication and access

• Passwords are hashed with bcrypt and a per-password salt. We never store them in plain text and cannot recover them.
• API access uses bearer tokens scoped to one organisation, revocable at any time.
• Five roles (owner, admin, manager, technician and viewer) decide who can sign, export, manage people and bill. Only the owner manages billing. Switching someone off locks them out on their next request.
• Internal administrative access is limited to staff who need it, is individually attributed, and is logged.

04Audit trail

Test records keep a full history rather than only the latest state. Creating, editing, finalising, locking, unlocking and exporting a test cycle are each recorded with actor and timestamp. Unlocking a finalised cycle is a deliberate, logged action, so a record cannot be quietly changed after sign-off.

05Infrastructure

The platform runs on managed cloud infrastructure in the United States. Databases are not publicly routable. Secrets are held in environment configuration, never in source control, and are rotated on staff change or suspected exposure. Dependencies are monitored for known vulnerabilities and patched on a risk-based schedule.

06Backups and continuity

The database is backed up continuously with point-in-time recovery, so it can be restored to a moment before a bad change within our hosting provider's recovery window, which is a matter of days. Backups are encrypted and access-controlled. Uploaded files are kept in separate storage.

07Data handling in AI processing

Content sent to model providers for extraction is covered by agreements that prohibit training on your data and limit retention to what is needed to serve the request. Extraction results are returned to you for review before they are written to a record. See the Privacy Policy for detail.

08Your data, your control

• Export: your records, at any time, in open formats including PowerDB-compatible CSV and PDF.
• Deletion: delete individual records yourself. Deleting your account removes your personal details at once.
• After you leave: your organisation's records stay until you ask us to delete them. Write to us and we will delete them and confirm in writing. Backups roll off within our hosting provider's recovery window.

09Incident response

We maintain an incident process covering detection, containment, eradication and review. If a breach affects your personal data we will notify you without undue delay and within any statutory deadline that applies, with what we know, what we are doing, and what you should do.

10Reporting a vulnerability

Email security@rmsautomation.ai with steps to reproduce and any supporting detail. We acknowledge within two business days and will keep you updated until it is resolved.

Please give us reasonable time to fix an issue before disclosing it, do not access or modify data that is not yours, and do not degrade the Service for other users. We will not pursue legal action for good-faith research that follows these guidelines.

11Your responsibilities

Security is shared. Use a strong, unique password. Remove seats promptly when someone leaves. Keep API tokens out of source control and rotate them if exposed. Review extracted values before you sign off on them.