Security

• Sign-in and session handling are managed by a specialist authentication provider; we never store passwords ourselves.
• Each person has their own account, created through an invitation from a company administrator.
• Access is controlled by role (admin, engineer and other configured roles) plus granular per-user permissions granted by an administrator.
• Admin & Office users can deactivate a user, which removes their access to company data.

• Every record carries the owning company, and database row-level security policies restrict reads and writes to the signed-in user's own company.
• Isolation is enforced in the database itself, not only in the interface, so it still applies to direct API access.
• Security-sensitive helper functions run with fixed privileges and are not executable by anonymous users.

• Photographs, drawings, site documents, logos and generated PDFs are held in private storage buckets — they are not publicly readable.
• Files are served through short-lived signed links generated only for authorised users.
• Client portal and emailed download links are token-based and expire (typically after 7 days) and can be revoked by an administrator.

• All traffic is encrypted in transit using HTTPS/TLS.
• Data at rest is encrypted by our hosting and storage provider.

• Important actions — sign-offs, document signatures, exports, portal access, invitations and permission changes — are recorded with the actor and timestamp.
• Email delivery attempts record status, attempt count, provider message and correlation identifiers and any error returned.
• Company administrators can review their own audit trail in the app.

Managed database backups are provided by our hosting provider. available on request

• Changes are reviewed before release and applied through versioned database migrations.
• Automated security scanning is run against the database schema and policies, and findings are triaged.
• Secrets and API keys are held in a managed secret store, never in application code.

available on request

Please report suspected vulnerabilities to support@ohmley.com. Include enough detail for us to reproduce the issue. We ask that you do not access other customers' data, do not degrade the service, and give us a reasonable time to respond before disclosing publicly. We will acknowledge reports and keep you updated.