Security, in plain language.

The surveyor decides

AI reads documents and drafts flags. Every certified figure is a person’s decision, recorded with their name and the time. The software never certifies a number on its own.

Where data lives

Our intent is to store Canadian data in Canada, and Australian and UK data in-region when we launch in those markets. Until that infrastructure exists we will tell design partners exactly where their data is held before they upload anything.

Isolation

Each firm’s data is isolated at the database level using row-level security. Lenders see only the reports and evidence a firm chooses to release to them.

Encryption

Data is encrypted in transit (TLS) and at rest by our hosting and database providers.

AI data handling

Documents sent to the AI provider for analysis are not used to train models and are not retained by the provider beyond the response, under the provider’s commercial terms.

Access control and logging

Access is limited to named people with a need for it. Changes to project data and every certification decision are written to an append-only audit log.

Reporting a problem

If you believe you have found a security issue, email hello@sitefact.ca with “Security” in the subject. We will acknowledge it within two working days.

For design partners

Design partners can request our data processing agreement and a fuller security description.