Payments by Stripe
Card details go straight to Stripe and never reach our servers.
Security
Where your data lives, and who can see it.
Your clients trust you with their homes, their names and their money. This page says plainly how SiteWrite looks after that, product by product, with nothing claimed that we do not do today.
SiteWrite Reports
- Where it is stored
- The application database, photographs and reports are held in the European Union (Ireland), with Supabase. The apps are served by Vercel.
- Kept apart from other firms
- Every firm’s data is separated at the database itself by row-level security, so one firm’s users can never read another firm’s records.
- Who sees what
- Surveyors, firm administrators and SiteWrite support each have their own level of access, and every account belongs to one person.
- Encrypted
- In transit with TLS 1.2 or higher, and at rest in the database and in file storage.
- Backed up
- The database is backed up every day and each backup is kept for seven days. Photographs and reports are copied every night to a separate, encrypted off-site store, and a full restore has been tested end to end.
- Photographs
- Full-size originals can be downloaded for 30 days and are deleted by 90. The compressed copies the report is built from are kept.
SiteWrite CRM
- Your own database
- Each firm’s CRM runs on its own separate database, hosted in London. It is never pooled with another firm’s data.
- Two-step sign-in
- Everyone in the office signs in with a password and a code from an authenticator app. The CRM will not open without both.
- Private links, not passwords
- Clients and the people doing the visits open private links that show only their own jobs, so there are no shared logins to leak.
- Access rules on every table
- What each role can see and change is enforced by the database, not only by the screens.
- Encrypted
- In transit and at rest, in the database and in file storage.
- A test mode
- Until you switch the CRM on for clients, every email and text it would send goes to you alone.
Both products
Built and run by a UK company.
The documents behind this page
Our Data Processing Addendum sets out these measures as commitments, and our sub-processors page lists every service we use and where it processes data.
Who we are
SiteWrite Ltd, registered in England and Wales, number 17177709. Registered office: 91 Princess Street, Manchester, M1 4HT.
Found a security problem, or need something for your own data protection records? Email hello@sitewrite.ai and a person will reply.
Questions
Questions firms ask about their data.
- Where is my data stored?
- SiteWrite Reports keeps its database, photographs and reports in the European Union (Ireland). SiteWrite CRM gives each firm its own database, hosted in London. The full list of the services we use, and where each one processes data, is on our sub-processors page.
- Can another firm see my data?
- No. In SiteWrite Reports every firm’s data is separated at the database by row-level security. In SiteWrite CRM each firm has a database of its own.
- Is SiteWrite training AI on my reports?
- No. SiteWrite does not train any AI model on your reports. When a surveyor asks the AI to write a paragraph, the inputs for that paragraph are sent to Anthropic’s Claude model and the text comes back for the surveyor to review. We log which prompt was used, a shortened copy of the inputs and the token count, not the text that was written.
- How are card payments handled?
- Through Stripe. Card details go straight to Stripe and never reach SiteWrite’s servers. In SiteWrite CRM, clients pay into your firm’s own Stripe account.
- Can we have a signed Data Processing Addendum?
- Yes. The Data Processing Addendum is part of our terms, and a signed copy is available on request from hello@sitewrite.ai.
See also our Privacy Policy and Terms of Service.