Support
For whoever runs this. Where things are, how to get a copy of everything out, and what to do when something has gone wrong.
Getting help
Through the office. If a page has failed, it will have shown a short reference on screen — send that with the message. It is the only thread back to what actually happened on the server, because the browser is deliberately not told the detail of an error in case it names a tenant or a connection string.
Getting everything out
An administrator can download the whole firm — every record and every uploaded photograph, certificate and document — as one file, from Settings, at any time. It restores into an empty system and keeps every reference intact.
It reads under the account of whoever asks for it, so a backup can never contain a row that person could not already see. It is a snapshot rather than continuous recovery: worth exactly what the last one taken was, so take one on a schedule and keep it somewhere that is not the office.
Where it all is
| Who | Holds | Where |
|---|---|---|
| Supabase | The database, the sign-in accounts, and the uploaded files. | Ireland (eu-west-1). |
| Vercel | Runs the application. Requests pass through it; nothing is stored there. | Wherever the firm chooses to deploy. London for a UK firm. |
| OpenStreetMap | Map tiles on the two map screens. The browser asks for a square of map by its coordinates, so it is told roughly where somebody is looking. No tenant detail leaves the application. | Europe. |
| Open-Meteo | The weather forecast. It is asked about the coordinates of the first job of the day, never about a person’s own position. | Germany. |
| The browser’s own push service | Google, Mozilla or Apple, depending on the browser the office uses. It carries the notification for a safety alert, and is told nothing except that there is one. | Set by the browser vendor. |
If personal information has got out
A lost phone still signed in, an account somebody should not have, a file sent to the wrong landlord, a suspected break-in. UK GDPR gives 72 hours from the moment somebody here becomes aware to report a reportable breach to the Information Commissioner. The clock starts at awareness, not at certainty.
- Stop it spreading. Deactivate the account on the Engineers page or in Settings. Signing somebody out clears everything held on their handset, which is why the engineer’s side caches anything at all.
- Write down what you know and when you knew it. The time somebody became aware is the fact the 72 hours is counted from, and it is the one nobody remembers a week later.
- Work out whose information it was. Settings holds a record of what was changed and by whom; a job’s own history holds the rest. Neither can be edited or removed.
- Tell the landlord. They own the relationship with the tenant and, for most of this, they are the ones who must report it.
- Report it if it is likely to be a risk to somebody — ico.org.uk, or 0303 123 1113. If it is not, record why you concluded that. That record is what a regulator asks for.
If somebody asks about their information
A tenant asking what is held, or asking for it to be removed, is answered from the property record — search for them by name or telephone number on the Properties page. Their name, number, email and any access note can be cleared in one action, which records that it was done and who did it.
The inspection record itself stays, and the reason is on the privacy notice: keeping an electrical safety record is a legal obligation on the landlord, and that is one of the grounds on which the right to erasure does not apply. Tell the person that plainly rather than agreeing and then not doing it.
A request for a copy is free and has one month to be answered. There is no button for it, because what is held about one person spans their property record and the work done there — a person puts it together, and both are on screen.