YOUR BUSINESS. YOUR DATA. YOUR CONTROL.

Company data separation

PROVE keeps every business's records apart from every other business's. Each job, customer, quote, invoice, form and photo belongs to one company, and the database only ever returns rows that match the company the signed-in person belongs to.

• Row Level Security is switched on for every application table, so access rules are applied by the database itself rather than by the website
• Every business table carries the company it belongs to, and the rules compare that value with the signed-in person's company on each read, insert, update and delete
• Checked by signing in as one company and counting the other company's customers, jobs, sites, evidence, photos, invoices, quotes, forms, shared links, portal records, Xero connections and stored files: none were visible
• Checked in both directions between two company accounts, and by attempting to write and to delete rows belonging to the other company: the insert was refused outright and the delete changed no rows

Sign-in and account security

Access to PROVE needs a signed-in account. Accounts are created with an email address and a password, and the email address has to be confirmed before the account is usable. Google sign-in is available as an alternative.

• Passwords are handled by the authentication service and are not stored by PROVE as readable text
• Email address confirmation is required when an account is created
• Google sign-in is available alongside email and password
• Sessions are held by the authentication service; a person only ever sees the data their own account is allowed to see
• A signed-out visitor cannot read customer, job, evidence, invoice or form records: those tables return nothing to a visitor who is not signed in, and some are refused outright

Roles, permissions and access controls

Being signed in is not the same as being able to see everything. Each person has a role, and permissions decide what that person can actually do. Field staff work on the jobs they are assigned to; owners and managers can see and run the wider business.

• Roles: Owner, Manager, Supervisor, Office Admin and Operative, each with sensible starting permissions
• Extra permissions can be granted or removed per person without inventing a new job title for every job
• Permission checks run in the database, so they still apply if someone calls the data API directly
• Job-level checks decide whether a person may open, edit, assign or complete a particular job
• Owners and managers control who joins the company and what each person can reach; invitations are limited by the plan's member allowance

Evidence and document storage

Photos, voice notes, form attachments and signatures are kept in private storage. Nothing is served from a public folder, and every file is reached through a short-lived, signed address that only the person entitled to see it can obtain.

• Both storage buckets are private: no record is available from a public URL
• Files are filed under the company's own folder, and the storage rules require that folder to match the signed-in person's company
• Form files must sit under the correct company and submission, and the submission has to be one that person is allowed to open and still be able to edit
• Signed addresses expire: about an hour for viewing evidence and form files, five minutes for images pulled into a generated PDF, and ten minutes for a shared PDF download
• Deleting a record keeps its audit history, so a removed file cannot silently rewrite the record of what was captured

Customer document sharing and approval links

When you send a quote, variation, invoice, form or job sign-off to a customer, PROVE creates a link that carries no password and no account. The link can be limited, time-boxed and withdrawn, and the customer's decision is written down permanently.

• Each share has its own unguessable token, an expiry date and a revoked flag
• The link is re-checked on every open: token, expiry, revocation, company and the document's current status
• A withdrawn or expired link stops working immediately, and the underlying document cannot be reached through it
• Quotes, variations and invoices are only viewable through a share once they are in a state that may be shown to a customer
• Accept, decline and sign-off decisions are stored once and cannot be edited or deleted, with the name, note, time and device recorded
• Job sign-off links show only the evidence you choose to include, and only one sign-off can be recorded per job

Data ownership and retention

Your business records are yours. PROVE holds them so your team can work with them, and keeps them for as long as your account is open. If your trial or subscription ends, the data is retained and stays readable; what stops is new work being written.

• Records are held for the life of the company account unless you ask us to remove them
• When a trial or subscription ends, staff writes are blocked by a database rule while existing records are retained
• Form drafts saved on a device are kept there until they reach the server, and successfully synced local copies are removed after 7 days
• Unsynced work is never deleted automatically: it survives closing the app, a crash, a reload and signing in as a different person
• Financial records are kept so you can still prove what you quoted, charged and were paid

Data deletion and account closure

Deletion is deliberate rather than casual, because job and financial history is evidence. Records that are still linked to work cannot be destroyed by accident; records with no history behind them can be removed, and whole jobs can be archived or permanently deleted by the owner.

• Customers can be permanently removed only when nothing is linked to them: no quotes, jobs, invoices, communications or Xero links on the customer or its sites. Otherwise they are deactivated
• There is no general delete route for customer records: removal goes through a checked function that refuses when history exists
• Jobs can be archived (keeping everything) or permanently deleted by the owner after an inventory, warnings, typed confirmation and a final confirmation
• Completed jobs are locked, so task and note history cannot be quietly rewritten afterwards
• Account closure and bulk removal of a company's data is handled by emailing us; there is no self-service delete button yet

Monitoring, audit history and incident response

PROVE keeps a running record of what happened to your records and who did it. That history is the first thing we look at if something looks wrong, and it is what we can show you afterwards.

• Evidence changes are written to an append-only audit trail with the person, action, reference and time
• Form activity (start, save, submit, decision, attachment, signature, void) is logged against the submission
• Customer portal activity is logged, and job events build a permanent timeline for each job
• Job notes are append-only, with the author and time set by the database from the signed-in account, so a note cannot be posted in someone else's name
• Customer decisions and job sign-offs are protected by database rules that block update and delete
• If we become aware of a breach that affects your records, we will tell the affected account holders without undue delay and explain what we are doing about it