Security

Last updated: September 2026

Fire risk assessments contain sensitive information about buildings and the people who use them. Protecting that data is a first-order concern in how we build and run Assura Safety. This page explains the main measures we have in place.

Infrastructure & hosting

Assura Safety runs on established, security-focused cloud platforms:

• Application hosting — Vercel. The application is deployed on Vercel’s managed platform, served entirely over HTTPS.
• Database — Neon. Application data is stored in a managed Neon Postgres database, isolated per environment.
• File storage — Cloudflare R2. Photo evidence and library documents are held in private buckets. Nothing is publicly readable: files are served only through short-lived, signed links issued to signed-in users.

Both providers operate their own mature security programmes and maintain recognised industry certifications (such as SOC 2). We rely on their managed infrastructure rather than running our own servers, which keeps patching, network security and physical security in the hands of specialist providers.

Encryption

Data is encrypted in transit using TLS across all connections — between you and the application, and between the application and its database — and encrypted at rest on our hosting and database infrastructure.

Authentication & two-factor

Every user authenticates to their own account, and passwords are stored using industry-standard one-way hashing — never in plain text.

Assura Safety supports two-factor authentication (2FA) at the application level. Individual users can enable 2FA on their own account, and administrators can enforce 2FA across an entire organisation, so every member is required to use it before they can access assessment data.

Access control

Data is scoped to your organisation, and access is governed by owner, admin and member roles so each person sees only what their role allows. Assessments are never shared across organisations, and members of one organisation cannot see another’s data.

AI-assisted action plans

When you record a non-compliance, Assura Safety can draft a prioritised remedial action for you. This drafting is powered by Anthropic’s Claude models, accessed through Anthropic’s API. The AI is a drafting aid — the competent assessor reviews, edits and approves every action.

Only the finding details needed to generate the draft are sent to Anthropic. Anthropic does not use data submitted through its API to train its models. Anthropic is based in the United States; where personal data is involved, transfers are covered by appropriate safeguards such as Standard Contractual Clauses.

Payments

Subscriptions and pay-as-you-go billing are handled by Stripe. Card details are entered on Stripe’s own hosted checkout and billing pages and are never sent to, processed by or stored on our systems — we hold only a Stripe customer reference and the plan you are on. Stripe is a PCI DSS Level 1 service provider.

Data location & sub-processors

Our core application and database infrastructure is hosted in the EU. We use a small number of trusted sub-processors under appropriate data-processing agreements:

• Vercel — application hosting (EU-based).
• Neon — managed Postgres database (EU-based).
• Resend — transactional email delivery (sends from Ireland).
• Cloudflare (R2) — private object storage for photo evidence and library documents.
• Stripe — payment processing and billing. Stripe receives your card and billing details directly; we do not see or store them.
• Anthropic (Claude) — AI drafting of action plans (US-based; does not train on API data; transfers covered by appropriate safeguards).
• Plausible — privacy-friendly, cookieless analytics on our public marketing website only. It does not run in the application and does not process any assessment data.

Backups & reliability

Our database provider maintains continuous backups with point-in-time recovery, so data can be restored following an incident. We monitor the service so we can respond quickly to issues.

Responsible disclosure

If you believe you’ve found a security vulnerability, please email [email protected] with the details. We’ll acknowledge your report and work with you to resolve the issue. Please give us a reasonable opportunity to fix it before any public disclosure.