Security

All traffic between the app and our servers runs over HTTPS, and data is encrypted at rest on the underlying storage, including uploaded photos and documents.

Access rules are enforced in the database itself, not just in the app. Every record is tied to a business, and a signed-in user can only reach records belonging to their own business. Manager-only areas such as insurance, vehicles and staff roles are restricted further.

Uploaded files live in private storage — links are short-lived and only issued to people in the owning business.

Our database, file storage and application servers are operated by a managed cloud provider with infrastructure located in Singapore. Backups are taken automatically by the platform. See the Privacy Policy for the full overseas-storage disclosure.

We maintain a documented breach response process: contain the incident, assess whether it is likely to cause serious harm, notify the Office of the Privacy Commissioner and affected people as soon as practicable where it is, record it in a breach register, and review what changed to stop it recurring.

If you believe you've found a security problem, email security@sitecrew.app with enough detail to reproduce it. Please don't access or modify other people's data while testing. We'll acknowledge your report and keep you updated while we investigate.