Security questionnaire, answered

Where is the application hosted?

Vercel (application, edge network) and Supabase (PostgreSQL, authentication, file storage), both in United States regions. Backups are copied nightly to Cloudflare R2.

Is data encrypted?

Yes. TLS 1.2 or higher in transit. At rest, the database, stored files and the nightly backup copy are encrypted with AES-256 by the providers that hold them (Supabase, on AWS, and Cloudflare R2); we do not add a second layer of our own.

How are customers separated?

One database with row-level security on every table; a request can only read or write rows of the workspace it is authenticated for. An automated matrix test runs in CI on every schema change, against a fresh schema, and fails if any table leaks between two seeded tenants.

Who at Sitesui can access our data?

Named staff accounts only, and the staff area does not open without two-factor. Support access to a workspace is read-only and is written to that workspace's audit log, which the customer can see.

What roles and permissions exist?

Owner, admin, inspector (member), viewer (read-only) and a billing seat. Members can be scoped to regions so a district manager sees only their district. Two-factor (an authenticator app, with ten single-use recovery codes) is optional for each user; owners and admins can require it for the whole workspace, and see who has it on.

Do you support SSO?

Google sign-in, one-tap email links, and domain-based sign-in rules are available. SAML/OIDC single sign-on is on the roadmap for enterprise agreements; ask.

How are backups handled?

A full nightly copy (database dump and every stored file) to a second provider, Cloudflare R2, which encrypts it at rest, scheduled outside the hosting platform so it does not share its failure mode; backup copies expire after 35 days. The copy is watched rather than assumed: the ten-minute check reads the last backup receipt and raises an alert when none has landed in 26 hours. A restore rehearsal into a clean database leaves its own dated pass/fail receipt. /status shows the date of the last completed copy; ask us and we will tell you the date of the last successful one.

What is your uptime?

Two automated checks. One runs every ten minutes on the hosting platform's own scheduler; the other runs from GitHub Actions, outside our hosting, because a check inside the app cannot notice the app being down — GitHub runs scheduled jobs when it has capacity, so that one is a second opinion rather than a metronome. Both leave a dated pass/fail receipt. We do not publish an uptime percentage yet, and /status says why; ask and we will send you the trailing 7-day figure from those receipts. Service credits and an SLA are available on enterprise agreements.

How do you handle incidents and breaches?

Every server error is written to an internal error log the moment it happens, and the automated checks alert on a change of state through two channels that do not share a failure mode — a push notification to a named administrator and email. We do not contract a response time outside an enterprise agreement. A personal-data breach affecting a customer is notified within 72 hours of confirmation, with updates as the investigation proceeds (DPA §6).

What third parties process our data?

Vercel, Supabase, Stripe, Resend, Twilio, Cloudflare, GitHub, X.AI LLC (xAI), Anthropic, OpenAI, Mapbox, Komoot GmbH (Photon). Each one, what it does, what personal data it can see and where it processes, is published at /legal/subprocessors and summarised in DPA §2. 30 days' notice by email before any addition, and you can ask to be on that notice list.

Where is data stored and can it be kept in-region?

United States. EU/UK customers are covered by the Standard Contractual Clauses in the DPA. In-region hosting is available on enterprise agreements.

How do we get our data out, or delete it?

CSV and ZIP exports from the product at any time; a full export on request from Settings → Danger zone; workspace deletion from the same page removes files, records, logins and any subscription, with deletion from backups as their copies expire (backup copies expire after 35 days).

Do you use customer data to train AI models?

No. Optional model calls (resident-report triage, which a workspace owner or admin can turn off under Settings → Workspace; the summary at the top of our own end-of-day business brief; editorial help on our own blog) send only the text needed for that call; optional voice-note transcription sends the audio clip and gets the words back. We train nothing on it, and the providers' API terms exclude API inputs from training; we keep every provider's opt-in data-sharing programme switched off and check that setting each quarter.

Is there a penetration test or SOC 2 report?

Not yet. Security review is part of every change (automated dependency review, CSP, signed webhooks, rate limits), and the tenant-isolation matrix runs in CI on every schema change. A third-party assessment is planned; ask for the current status.

Who do we contact?

hello@sitesui.app. Security reports to the same address are read by a person, and answered first.

Something your questionnaire asks that isn't here? Send it to hello@sitesui.app; the answer is added to this page.