Each company sees only its own records
Every table that holds customer data carries the company (organization) it belongs to, and Postgres row-level security restricts each signed-in user to their own company’s rows. Owners invite technicians; both roles work inside the same company boundary.
Public pages expose only public fields
The QR verification page and the booking-request link do not read your tables directly. They call restricted database functions that return only the fields meant for the public, such as the company name, site name and city, service date, and pass/fail status. Anyone with the link can open it, so keep confidential notes out of public fields.
Files are private
Photos, signatures, and PDF reports are stored in private storage buckets scoped to your company and served only through signed links or signed-in requests. Company logos are public because they appear on shared reports.
Encryption and integrity
Traffic to InspectRenew uses HTTPS (TLS). Data at rest is encrypted by our infrastructure providers. Each generated PDF gets a SHA-256 fingerprint so later changes to the file can be detected; this is not a PAdES digital signature.
Where data is processed
- Supabase: Database, sign-in, and file storage (photos, signatures, PDF reports).
- Vercel: Hosting for the website and web app, and scheduled reminder jobs.
- Stripe: Subscription checkout and billing portal. Card details go to Stripe, not to us.
- Resend: Delivery of reminder and account emails.
- Twilio: SMS reminders, only when SMS is enabled on Pro.
InspectRenew is a US business service. Analytics and advertising cookies stay off until you accept them; see the privacy policy.
Retention and deletion
Records are kept while your account is active so reports and QR links keep working. When an owner deletes the company in Settings, access ends immediately. To have records permanently erased, email support@inspectrenew.com; backup copies can take longer to expire than the active service.
What we do not claim
InspectRenew does not hold SOC 2, ISO 27001, or similar certifications today. Report a suspected vulnerability to support@inspectrenew.com with “Security” in the subject.