Security & trust
Built for compliance, including our own.
Multi-tenant isolation, Microsoft Entra External ID sign-in with MFA enforced on every account, encryption at rest and in transit, and GDPR-aligned processing. Your data is stored in the UK (Microsoft Azure UK South, backups in UK West). US hosting is available on request.
We treat security like a product feature, not a checkbox. Hovermarks is built on the same Azure primitives you'd use to run a regulated workload of your own.
The pillars of our trust posture
Each one is documented in our trust packet (available under NDA). The full controls catalogue is published in our Information Security Policy.
Read the policy: /legal/information-security-policy. Covers governance, risk management, access control, cryptography, operations, supplier security, incident management, business continuity, and compliance.
Multi-tenant isolation
Every customer gets a logically isolated tenant. Tenant isolation is enforced through query filters that apply automatically to every database read, scoped to the authenticated tenant claim. Foundational tests fail loudly the moment a query forgets the tenant filter.
Microsoft Entra External ID sign-in
Microsoft Entra External ID with PKCE. MFA is enforced on every sign-in by Conditional Access on the Hovermarks identity tenant. No opt-in, no plan gate. Professional and Enterprise customers can also federate to their own Entra tenant and layer their own Conditional Access on top; talk to sales to enable. No shared service accounts, no orphaned access.
Email sign-in with MFA on every account, every plan
Every user signs in with their email address and a password, with a one-time code sent to their verified email, enforced on every account, every plan. Identity is handled by Microsoft Entra External ID. MFA is enforced by Conditional Access on the Hovermarks identity tenant, required on every account, on every plan, including Starter trials. No SMS in the loop. Professional and Enterprise customers can also layer their own Entra Conditional Access on top to add device compliance, trusted-network rules, or stricter session policies. Session integrity is verified on every API call via signed JWTs with short expiry.
Encryption at rest and in transit
TLS 1.2+ in transit on every request. Encryption at rest via Microsoft-managed keys (Azure Postgres Flexible Server data encryption + Storage SSE), with strict per-tenant data isolation enforced at the application layer.
Data residency: UK South + UK West
Your data is stored in the UK, in Microsoft Azure UK South, a Microsoft datacentre region with the same security controls as Azure US regions. Database records and blob attachments (photos, report files, tenant logos) are geo-replicated to Azure UK West for regional disaster recovery. Both are UK-sovereign Microsoft datacentres, so stored data stays in the UK; the one exception is the opt-in Azure OpenAI features, whose prompts may be processed in other Azure regions. UK GDPR is functionally equivalent to GDPR; our DPA includes EU Standard Contractual Clauses for cross-border transfer. US hosting is available on request on every plan. It is not set up by default: if you need it, ask us before you sign up and we will agree the arrangement and timing with you.
GDPR-aligned by design
Soft-delete: deleted records are retained, and a deleted organisation can be restored within 30 days. Per-tenant JSON export on request. Hard-delete after retention with blob cleanup and a tamper-evident ledger entry. Customer data hosted in Azure UK South under UK GDPR (functionally equivalent to GDPR), with geo-replicated backups in UK West and EU SCCs available in our DPA.
Tamper-evident audit log
Changes to core records (assets, inspections, defects, work orders, actions, checklists, sites, categories, schedules, documents) and key account events (role, licence and API key changes) are recorded with actor and timestamp on an append-only, hash-chained log. Writes happen for every tenant; in-dashboard search and filter is gated to Professional and Enterprise. Sign-ins are not in this log; Microsoft Entra External ID keeps its own sign-in records.
Auditor pack export
On every plan, an Admin can generate a single PDF that bundles the inspections completed in a period (up to 18 months) with the first 80 matching audit-log entries and the result of an integrity check over all of them, to send to an auditor or insurer. No Hovermarks login required for them to read it.
One organisation per session
Every session is scoped to one organisation, and database-level query filters guarantee no row from a different tenant is ever returned. One sign-in can belong to several organisations, such as a contractor working for several clients, but each session sees only the organisation currently selected.
Point-in-time backup, drilled quarterly
Azure Postgres Flexible Server with point-in-time restore (PITR) over a 7-day rolling window and geo-redundant backup replicated UK South → UK West. We don't trust untested backups. The restore drill is run every quarter against a throwaway server and the result is published to our internal disaster-recovery runbook. RTO target ~4 hours, RPO target ~1 hour.
Responsible disclosure
Found something? Email security@hovermarks.com. We acknowledge reports promptly and credit researchers who would like to be named.
Reporting a vulnerability
If you've found a security issue in Hovermarks, here's how to tell us.
Email security@hovermarks.com with a clear description of the issue and the steps to reproduce it. Screenshots, request/response captures, or a short screen recording are welcomed. Use a private host you control. We don't accept attachments at the inbox.
We acknowledge every report within 1 business day and provide a fix-or-status update weekly until the issue is resolved or formally closed. Where a fix is shipped, we'll confirm the build that contains it so you can verify.
Public disclosure: please coordinate the timing with us. Our standard window is 90 days from a confirmed fix, earlier by mutual agreement, longer for active exploitation cases.
We don't currently operate a paid bug-bounty programme. Acknowledgment in our security advisories is offered for novel, high-impact findings.
Machine-readable contact details follow RFC 9116 at /.well-known/security.txt.
For US procurement
The questions your security review will ask.
Answered here so you can forward this page instead of waiting on a questionnaire response.
- Where is our data stored?
- Microsoft Azure UK South, a UK-sovereign datacentre, with geo-redundant backups in Azure UK West. Both are Microsoft regions. Stored data does not leave those two regions; the exception is the opt-in Azure OpenAI features, whose prompts may be processed in other Azure regions.
- Can we get US data residency?
- On request, yes. By default your data is stored in the UK (Microsoft Azure UK South, backups in UK West). US hosting is available on request on every plan. It is not set up by default, so ask us before you sign up and we will agree the arrangement and timing with you.
- Who are your sub-processors?
- Named and published, with the region each one operates in, on the sub-processor page. Microsoft Azure carries the customer-data plane; the others cover authentication, email, payments, and the opt-in AI features. We notify customers before a new sub-processor starts processing.
- Do you sign a DPA, and what does it cover?
- Our Data Processing Agreement is published rather than negotiated from scratch: processing scope, sub-processor terms, security measures, deletion and return of data, audit rights, and transfer mechanisms. Enterprise customers can put a custom DPA and MSA in place.
- How fast is breach notification?
- Without undue delay and within 72 hours of becoming aware, per the DPA, with the nature of the incident, the data categories affected, our containment steps, and the contact point for follow-up. State-law notification duties in the US sit with you as controller; we give you what you need to meet them.
- What happens to our data if we leave?
- Export your asset registers, inspections, and report metadata as CSV, including while your organisation is read-only after your subscription ends, and ask us for a JSON export of the whole tenant, which we produce on request. From 9 December 2026, an organisation that stays read-only is deleted automatically 12 months after its subscription ends (90 days after a trial ends), with emails to its admins 30 and 7 days before. Deletion runs soft first: a deleted organisation can be restored by Hovermarks within 30 days. After that it is hard-deleted with blob cleanup, and a tamper-evident ledger entry records that it happened.
Security FAQ
Stop chasing paperwork.
Start proving compliance.
Tag your first asset, run your first inspection, and export an auditor pack, all on your free 30-day trial. No credit card required.