Visits Record
Start

Security

How we protect your visitor data.

This page is maintained by the Visits Record team to answer common security questions. It reflects the controls currently enabled in the product. It is not a third-party certification.

Data storage & tenancy

  • All data stored in Postgres with row-level security enforced at the database layer.
  • Each company is a strict tenant boundary; one company's admins can never read another's records.
  • Guards and managers are further scoped to their assigned sites via the site_staff table and RLS policies.

Encryption

  • TLS 1.2+ for all traffic (HSTS with preload).
  • Encryption at rest for the primary database and object storage (visitor selfies).

Authentication

  • Email + password with a 12-character minimum and OTP verification on signup.
  • Rate limits on failed auth attempts and visitor form submissions to block credential stuffing and abuse.
  • Session tokens short-lived; refresh handled by Supabase Auth.

Access control

  • Roles: super admin (platform), company admin, manager, guard.
  • Every privileged RPC is SECURITY DEFINER and re-checks the caller's role and site scope before executing.
  • Admin actions are audit-logged.

Retention & deletion

  • Per-site retention windows (default 90 days for standard sites, configurable up to statutory maximums).
  • Automatic purge of visitor records past the window; associated selfies removed from object storage.
  • Data-subject access requests answered within 30 days via search-by-phone export.

Infrastructure

  • Hosted on Vercel (edge network) with strict security headers: CSP, HSTS, X-Frame-Options DENY, COOP, CORP.
  • Backend on Supabase (Postgres + Auth + Storage) in AWS regions with SOC 2 / ISO 27001 sub-processor coverage.

Incident reporting

Report a security concern to security@visitsrecord.com. We acknowledge within 24 hours and issue a coordinated disclosure timeline for verified vulnerabilities.

What we do not claim

We do not currently hold independent SOC 2, ISO 27001, or HIPAA certification. Enterprise customers can request a DPA and shared-responsibility statement from the pricing page.