Security

HousingSurvey Pro exists to make evidence defensible, so the security model is the product. Designed against Cyber Essentials and ISO/IEC 27001 controls from the first commit (certification on the roadmap); our security design notes and DPA are available to any customer's IT team — email [email protected].

UK data residency, enforced in code

Firestore, storage, functions and authentication run in the Google Cloud London region (europe-west2). Region pinning is written into the codebase, not a policy document.

Server-authoritative finalize

Completion timestamps are set by our servers. A surveyor's device clock — right or wrong, honest or not — never dates the evidence.

Lock-on-Complete

Finalized records are immutable to every client: surveyor, manager, admin, and our own staff accounts. Corrections create superseding records; originals survive. Enforced by database security rules and covered by an automated test suite.

Per-property hash chains

Each finalized record embeds the SHA-256 of its canonical content chained to the previous record for the same UPRN. A nightly verifier recomputes every chain and records its clean runs — absence of tampering is provable, not assumed.

Append-only audit

Every create, edit, finalize, export, API read, key mint and billing event is written to a hash-chained, client-unwritable audit log per organisation.

App attestation (App Check)

Enforced from day one: web clients attest via reCAPTCHA, iOS via App Attest, Android via Play Integrity. Scripts and tampered apps don't reach the data plane.

Tenant isolation

Access rides on signed custom claims minted only server-side. Contractors reach a landlord's stock only through explicit grants and work orders. Cross-tenant denial is unit-tested.

Keys stored hashed, shown once

API keys, SCIM tokens and webhook signing secrets are displayed once and stored only as SHA-256 hashes. Webhook payloads are HMAC-signed.

Your identity provider

Enterprise organisations bring Entra ID: OIDC single sign-on and SCIM joiner/leaver provisioning, configured self-serve — your directory is the source of truth for access.

Minimal personal data

Records describe properties, not people. Billing runs on Stripe (PCI-DSS theirs); we hold no card data. Sub-processors: Google Cloud (UK), Stripe, Ordnance Survey (address strings only).

Responsible disclosure: report vulnerabilities to [email protected] — we acknowledge within 48 hours and don't pursue good-faith researchers.