Security
HousingSurvey Pro exists to make evidence defensible, so the security model is the product. Designed against Cyber Essentials and ISO/IEC 27001 controls from the first commit (certification on the roadmap); our security design notes and DPA are available to any customer's IT team — get in touch (procurement/security route). For RFP-grade detail — architecture, infrastructure, our compliance mapping, evidence integrity and access control — see the Trust & Security Handbook and the sub-processor register.
- UK data residency, enforced in code
- Firestore, storage, functions and authentication run in the Google Cloud London region (europe-west2). Region pinning is written into the codebase, not a policy document.
- Server-authoritative finalize
- Completion timestamps are set by our servers. A surveyor's device clock — right or wrong, honest or not — never dates the evidence.
- Lock-on-Complete
- Finalized records have no edit or delete path for any client — surveyor, manager, admin, or our own staff accounts. Enforced by database security rules and covered by an automated test suite. Beyond that client-side lock, every sealed record is hash-chained to the one before it: any change made to a record after sealing, by any means, breaks the chain and is detected by our nightly verifier. Corrections create superseding records; originals survive.
- Per-property hash chains
- Each finalized record embeds the SHA-256 of its canonical content chained to the previous record for the same UPRN. A nightly verifier recomputes every chain and records its clean runs — absence of tampering is provable, not assumed.
- Append-only audit
- Every create, edit, finalize, export, API read, key mint and billing event is written to a hash-chained, client-unwritable audit log per organisation.
- App attestation (App Check)
- Enforced from day one: web clients attest via reCAPTCHA, iOS via App Attest, Android via Play Integrity. Scripts and tampered apps don't reach the data plane.
- Tenant isolation
- Access rides on signed custom claims minted only server-side. Contractors reach a landlord's stock only through explicit grants and work orders. Cross-tenant denial is unit-tested.
- Keys stored hashed, shown once
- API keys, SCIM tokens and webhook signing secrets are displayed once and stored only as SHA-256 hashes. Webhook payloads are HMAC-signed.
- Your identity provider
- Enterprise organisations bring Entra ID: OIDC single sign-on and SCIM joiner/leaver provisioning, configured self-serve — your directory is the source of truth for access.
- Minimal personal data
- Records describe properties, not people. Billing runs on Stripe (PCI-DSS theirs); we hold no card data. Sub-processors: Google Cloud (UK), Stripe, Ordnance Survey (address strings only).
- Documented security governance
- An internal ISMS policy set — information security, access control and a quarterly access review, incident response, business continuity and disaster recovery, data retention, and vendor management — sits behind the platform controls, with the founder as interim CISO. Alongside it we maintain a UK GDPR record of processing and a data-subject-request procedure. Mapped control by control in our compliance mapping, and shared with your procurement team on request.
Responsible disclosure: report vulnerabilities to [email protected] — we acknowledge within 48 hours and don't pursue good-faith researchers.
Questions a security reviewer actually asks
Can HousingSurvey Pro data leave the UK?
No. Firestore, Storage, Cloud Functions and Authentication are all pinned to the Google Cloud London region (europe-west2) in the codebase itself, not by policy — there is no configuration path that stores or processes tenant data outside the UK.
Can a finalized (sealed) record be edited or deleted?
Not through any client or API path, by any role, including our own staff accounts — enforced by database security rules and covered by an automated test suite. Every sealed record is also hash-chained to the one before it for its property: any change made after sealing, by any means including direct database access, breaks the chain and is detected by our nightly verifier. Not even we can edit history undetectably. Corrections create superseding records; originals survive.
How is evidence tampering detected?
Each finalized record embeds the SHA-256 hash of its canonical content, chained to the previous record for the same UPRN (property reference). A nightly verifier recomputes every chain end to end and records its clean runs, so the absence of tampering is provable, not merely assumed.
Is HousingSurvey Pro Cyber Essentials or ISO 27001 certified?
The platform is designed against Cyber Essentials and ISO/IEC 27001 controls from the first commit; formal certification is on the roadmap and not yet held. We do not claim certification we don't have — contact us for our current security design notes and DPA.
How are API keys and webhook secrets protected?
API keys, SCIM tokens and webhook signing secrets are shown once at creation and stored only as SHA-256 hashes thereafter — we cannot retrieve them either. Webhook payloads are HMAC-signed so receivers can verify authenticity.