RAMS documents carry the details of how work gets done on your sites — methods, sequences, the people involved. We treat them accordingly. Here is exactly how your data is held, who can reach it, and what we do with it.
Your documents are stored on UK infrastructure, sent over encrypted connections, and every query is scoped to your organisation. Uploads, decisions and changes are recorded. Your documents and data are encrypted when stored, on Microsoft Azure in the UK, and whenever they are sent (TLS 1.2 or higher).
Built to ISO 27001 standards and operated under UK GDPR. An audit trail of who uploaded, decided and changed what, and when.
We keep your reviewers' corrections with the documents they relate to, and may use them to improve the service. It's on by default, and we'll switch it off for your organisation on request.
Your data and documents are stored in the UK, on Microsoft Azure in the UK South (London) region. SaferSite is a UK company currently serving UK customers; as we open in other regions our intention is to host customer data within the customer's own region.
Only authorised users within your own organisation, and the subcontractors you invite to a specific site. Every query is scoped to your organisation and site, so no other customer can see your content — not your documents, not your findings, not your site rules.
Yes. When your reviewers correct, dismiss or add a finding, that judgement is kept with the document it relates to, and we may use it to improve the service. Your documents are never sold, never shared with another customer and never shown to one. This is on by default; if you'd rather your organisation was excluded, we'll switch it off for you.
Your documents are sent to our model provider to produce the review. Its published policy is that it does not log or store prompts or outputs for the open models we use unless the customer opts in.
Role-based, from director down to viewer. Each role sees only what it needs — billing is restricted to a single administrator role, site and team management is closed to subcontractors and viewers, and reviewers are scoped to their own sites. Sessions are held in a secure, httpOnly cookie and passwords are hashed.
SaferSite is built to ISO 27001 standards — access control, audit logging, input validation, environment isolation and change management are all implemented against those controls. We are not currently certified against ISO 27001 or SOC 2, and we would rather tell you that plainly than imply otherwise. If certification is a procurement requirement for you, talk to us about timelines.
If you leave, ask us and we will export your data and then delete it. Audit and financial records are kept for as long as the law requires.
The full legal position is set out in our Privacy Policy and Terms of Service. For security questionnaires, due diligence, or anything not answered here, contact support@safersite.app.