Support
For whoever runs this. Where things are, how to get a copy of everything out, and what to do when something has gone wrong.
Getting help
Through the office. If a page has failed, it will have shown a short reference on screen — send that with the message. It is the only thread back to what actually happened on the server, because the browser is deliberately not told the detail of an error in case it names a tenant or a connection string.
Getting everything out
An administrator can download the whole firm — every record and every uploaded photograph, certificate and document — as one file, from Settings, at any time. It restores into an empty system and keeps every reference intact.
It reads under the account of whoever asks for it, so a backup can never contain a row that person could not already see. It is a snapshot rather than continuous recovery: worth exactly what the last one taken was, so take one on a schedule and keep it somewhere that is not the office.
Where it all is
| Who | Holds | Where |
|---|---|---|
| Supabase | The database, the sign-in accounts, and the uploaded files. | Ireland (eu-west-1). |
| Vercel | Runs the application. Every request passes through it, and it keeps a short-lived log of each one — the page or address asked for, when, and the network address it came from — and of the errors the application reports. Nothing else is stored there. What is typed into the office search is sent in the body of the request, not in its address, so it is not in that log. Vercel is a United States company. | Dublin (Ireland). |
| OpenStreetMap | Map tiles on the three map screens. The browser asks for a square of map by its coordinates, so it is told roughly where somebody is looking. No tenant detail leaves the application. | Europe. |
| Google Maps | Only when somebody presses a directions or map link: the address of the property, or the position sent with a safety alert, is opened in Google Maps in their own browser. Nothing is sent to Google until that link is pressed. | United States. |
| Cloudflare cdnjs | The firm’s report forms load standard script libraries from this public library when a form is opened. The browser fetching a script tells it the network address it came from; nothing typed into a form can be sent to it. | Worldwide. |
| jsDelivr | The same, for the libraries a form loads from jsDelivr: the network address of the browser fetching them, and nothing typed into the form. | Worldwide. |
| Microsoft OneDrive | Holds the nightly backup of the whole database and its files — every category on this page. The 30 most recent nights are kept and older ones deleted, so a backup ages out within about 30 days. | Set by the firm’s Microsoft 365 account. |
| Open-Meteo | The weather forecast. It is asked about the coordinates of the first job of the day, never about a person’s own position. | Germany. |
| The browser’s own push service | Google, Mozilla or Apple, depending on the browser the office uses. It carries the notification for a safety alert, and is told nothing except that there is one. | Set by the browser vendor. |
| Anthropic | Three things, each only when a person asks for it. Reword: the text of an engineer’s note, with telephone numbers and names taken out. Reading a certificate, where the firm has switched it on: the text of the certificate with the address, postcode, names, telephone numbers and emails taken out — but a scanned certificate is sent as pictures of up to six pages, and those cannot have anything taken out, so they include the address and any names on them. Suggesting an import’s columns, where the firm has switched it on: the column headings and up to three sample rows, with names, telephone numbers and emails taken out. The last two are off unless the firm switches them on. SAM keeps only a fingerprint of what was sent, never the text. | United States. |
| Resend | Sends the emails SAM sends: appointment notices and reminders to tenants (their name, email address, the property address and the appointment), work summaries and portal links to clients, and password-reset and sign-in emails to staff. It keeps a record of each email it delivers, which ages out within about 30 days. | United States. |
| postcodes.io | Turns a property’s postcode into map coordinates, so jobs can be placed on the map and grouped by distance. Only the postcode is sent, never a name or street address. | United Kingdom. |
| Companies House | When the office looks up a client company by name or number, the search is sent to Companies House. Only what the office types is sent; no tenant details. | United Kingdom. |
If personal information has got out
A lost phone still signed in, an account somebody should not have, a file sent to the wrong landlord, a suspected break-in. UK GDPR gives 72 hours from the moment somebody here becomes aware to report a reportable breach to the Information Commissioner. The clock starts at awareness, not at certainty.
- Stop it spreading. Deactivate the account on the Engineers page or in Settings. Signing somebody out clears everything held on their handset, which is why the engineer’s side caches anything at all.
- Write down what you know and when you knew it. The time somebody became aware is the fact the 72 hours is counted from, and it is the one nobody remembers a week later.
- Work out whose information it was. Settings holds a record of what was changed and by whom; a job’s own history holds the rest. Neither can be edited or removed.
- Tell the landlord. They own the relationship with the tenant and, for most of this, they are the ones who must report it.
- Report it if it is likely to be a risk to somebody — ico.org.uk, or 0303 123 1113. If it is not, record why you concluded that. That record is what a regulator asks for.
If somebody asks about their information
A tenant asking what is held, or asking for it to be removed, is answered from the property record — search for them by name or telephone number on the Properties page. Their name, number, email and any access note can be cleared in one action, which records that it was done and who did it.
The inspection record itself stays, and the reason is on the privacy notice: keeping an electrical safety record is a legal obligation on the landlord, and that is one of the grounds on which the right to erasure does not apply. Tell the person that plainly rather than agreeing and then not doing it.
A request for a copy is free and has one month to be answered. There is no button for it, because what is held about one person spans their property record and the work done there — a person puts it together, and both are on screen.