Built to be trusted with property and resident data

Where your data lives

Application

Runs on Vercel. Every request carries a per-request Content Security Policy with a nonce, and HTTPS is enforced with HSTS.

Database

PostgreSQL hosted by Supabase on AWS in the United States (us-west-2). Every workspace table is protected by row-level security keyed to your workspace, checked by the database itself on every query — not only by the application.

Photos, video and documents

Stored in private buckets. Nothing is served from a public URL: every image in a report or on a share page is a signed link that expires.

Backups

Designed to copy the full database and every stored file to a second provider each night, separate from the primary host, and watched rather than assumed: the ten-minute check raises an alert when a night's copy has not landed. Backup copies expire after 35 days. The date of the last completed copy is on /status, including when it is behind.

Payments

Handled by Stripe. Card numbers never touch Sitesui.

Email and text messages

Sent through Resend and Twilio. Vendor texts require double opt-in and stop on STOP. Texts are paused while our text-message number finishes carrier verification; until they are back, the job goes by email with a link the vendor answers from.

Everyone else

Every other company that can touch your data is named at /legal/subprocessors, with what it does, what personal data it can see and where it processes.

Who can see what

• Your team. Owners and admins manage the workspace, billing and the roster; members inspect and edit. Only owners and admins can delete records or reopen a completed report.
• Outsiders you invite. A resident, vendor, client or signer opens a single link that shows one record and nothing else. Links expire and can be revoked by you at any time. Every action through a link is recorded under that person's name.
• Sitesui staff. Platform access is limited to named administrators, and support actions on a customer workspace are written to the same audit log you can read.
• Billing and plan fields cannot be changed through the API by a customer, even with a valid session: database triggers reject the write.
• Cross-workspace checks run in CI on every schema change: a member of one workspace is asserted unable to read, change or move any row belonging to another.

For procurement

Three pages, written to be forwarded to a board or an IT reviewer without a call first. The standard security questionnaire is answered and published; the Data Processing Addendum is part of the Terms for every customer, and a signed copy is two business days away; the sub-processor list names every company that can touch your data, what it sees and where.

Reporting a vulnerability

If you believe you have found a security issue, email us directly; a person reads it and answers it first. Please include steps to reproduce; we ask that you do not access other customers' data while testing.