How your data is handled.

Every completed review is rendered to PDF, stamped with a UTC timestamp, and hashed with SHA-256. The hash is printed in the document footer. If a single character of the document changes, the hash stops matching — which is exactly what makes it useful later.

Both parties sign digitally — drawn or typed. Each signature is stored with the signer's name, the time of signing, and the IP address of the signing device, and all three appear on the final PDF.

Employees never create accounts. They receive a one-time magic link by email that expires (14 days for self-assessments, 24 hours for countersigning). There is no employee password database because there are no employee passwords.

Every row of data is scoped to one company and enforced at the database layer with row-level security — not just in application code. One business can never query another business's employees or reviews, even if application code had a bug.

The database and file storage run in Supabase's Sydney region (AWS ap-southeast-2). Employee records don't leave the country to sit in a US data centre.

Billing runs entirely through Stripe. Card numbers never touch our servers and we cannot see them.

Signed reviews are kept for seven years, matching Australian employment record-keeping expectations. Draft and unsigned material is yours to delete at any time.

Something specific you need for your own compliance? Ask via the contact page — straight answers, no runaround.