Trust & security
Floor plans are sensitive. We treat them that way.
Building layouts, security equipment and visitor movement are some of the most sensitive data an organisation has. Here is how we look after it.
01Security
Your data stays yours
- Ownership
- You own your geometry, content and analytics. We process it to run the service and nothing else.
- Export
- Full export in open formats on every plan, at any time, with no notice period.
- Deletion
- Delete a venue and its data is removed from production systems within 30 days.
- AI training
- Customer drawings, scans and maps are not used to train models.
02Security
Hosting and encryption
- Regions
- EU hosting by default, with US hosting available. Enterprise plans can pin data to a region.
- In transit
- TLS 1.2 or later for every connection.
- At rest
- AES-256 encryption for databases, object storage and backups.
- Backups
- Daily encrypted backups with point-in-time recovery.
03Security
Access control
- Single sign-on
- SAML and OIDC SSO, with SCIM provisioning on Enterprise.
- Roles
- Per-workspace, per-venue, per-floor and per-layer permissions.
- Audit logs
- Every edit, publish, export, API call and agent action is logged.
- API keys
- Scoped, rotatable keys with read-only and per-venue options.
04Security
Privacy
- GDPR
- A data processing agreement is available to every customer.
- Positioning
- Visitor positioning is opt-in, and analytics are aggregated and anonymised.
- Imagery
- Faces and screens in 360° imagery are blurred before publishing.
- Accessibility
- No accessibility overlays on our sites. We fix the underlying markup instead.