Security and data protection
Who holds your inspection, safety and asset records, where they are hosted, how they are kept apart from other customers' records, and how you get them out or delete them. Everything here is also in the privacy policy.
The responsible party and the Information Officer
- Responsible party (POPIA)
- Inspecable (Pty) Ltd
- Registration number 2026/697227/07
- Database and file storage
- Supabase, in Singapore (AWS ap-southeast-1)
- Cross-border transfer under POPIA section 72
What is in place today
Where your data is hosted
The database and file storage (photos, signatures, documents) are hosted by Supabase, in Singapore (AWS ap-southeast-1). That is a transfer outside South Africa, and we rely on contractual safeguards with our providers that meet POPIA's conditions for cross-border transfer in section 72.
Encrypted connections
All data moves between the Android app, the web dashboard and our servers over encrypted connections (HTTPS/TLS).
Each organisation's records kept apart
Every organisation's records are separated by row-level security in the database itself, so the rule that one organisation cannot read another's records is enforced where the data lives, not only in the app's screens.
Role-based access
What a person can see and do follows their role: field users work in the mobile app; admins, asset managers and super admins get the web dashboard, with super admin seats capped at three. Access is enforced in the database.
A verifiable history on every inspection
Every inspection carries a hash-chained history of its sign-offs and amendments that you can verify on demand, from the dashboard or the Android app. It covers inspections; it is not an organisation-wide audit log.
Your records, exportable
Every completed inspection produces a signed PDF with its photos. A date range of completed inspections exports as one ZIP: an index spreadsheet plus each signed PDF. Registers and reports export to XLSX and PDF.
Account and data deletion
A user can delete their account and associated personal data in the app (Profile, then Delete Account) or by request. Deletion requests are processed within 30 days. Account data is otherwise kept for as long as the account is active or as needed to provide the service and meet your own record-keeping needs.
Account and data deletionCard details never reach us
A subscription bought on this website is paid through Paystack, which receives the card details directly. We never see or store them.
Short answers for the security questionnaire
Each answer says only what the privacy policy and the product already do. Anything not answered here, ask us directly.
Who is responsible for our data under POPIA?
Inspecable (Pty) Ltd, registration number 2026/697227/07, is the responsible party. The Information Officer is Vela Lengululego Sabelo, reachable at info@inspecable.com.
Where is our data stored?
The database and file storage are hosted by Supabase, in Singapore (AWS ap-southeast-1), outside South Africa. The transfer relies on contractual safeguards that meet POPIA's conditions for cross-border transfer in section 72.
Is data encrypted in transit?
Yes. Every connection between the app, the dashboard and our servers uses HTTPS/TLS.
Can another customer see our records?
No. Each organisation's records are separated by row-level security in the database, so the separation is enforced by the database rather than by the app's screens alone.
Can we control who sees what?
Yes. Access follows each person's role (field user, admin, asset manager, super admin), and the role is enforced in the database.
Can we check that an inspection record has not been altered?
Each inspection keeps a hash-chained history of its sign-offs and amendments. The verify action on the dashboard or in the Android app checks that history on demand.
Can we get our data out?
Yes. Export a date range of completed inspections as one ZIP with an index spreadsheet and each signed PDF with its photos; registers and reports export to XLSX and PDF.
How are accounts and data deleted?
In the app under Profile, then Delete Account, or by request to the Information Officer. Requests are processed within 30 days. The steps are on the account and data deletion page.
Your IT or procurement team can ask the Information Officer
For a security questionnaire, a contract clause or a control this page does not cover, email Vela Lengululego Sabelo, the Information Officer, at info@inspecable.com.