Security and data
How we keep your data separate and safe
GuardLink holds licence, vetting and attendance records about real people. This page says how that data is protected, where it lives, and what we do not yet claim.
Tenant isolation
Every record belongs to one company account. Access is restricted to that company's users by row-level security policies in the database, not only by the application.
Role-based access control
Access within a company is governed by role: owner, admin, operations manager, manager, supervisor, HR, finance and guard. Each role has its own set of modules and actions.
Authentication
Sign-in is handled through a dedicated authentication provider, with session tokens rather than shared or hardcoded credentials.
Audit logging
Sign-ins, account and billing changes, and platform administrator actions are recorded in an activity log. Scheduling overrides are recorded with the reason given.
Secure data handling
Data is transmitted over encrypted (HTTPS) connections.
Managed infrastructure
The platform runs on managed cloud infrastructure (Supabase on AWS) and does not operate its own servers for the database, authentication or file storage.
Monitoring
Platform administrators have visibility into system health and activity, so operational issues can be identified and addressed.
Access controls
Administrative access to customer data is restricted to authorised platform personnel and limited to what's needed to provide support.
Where your data is held, and who handles it
Your company is the data controller for the employee and operational data you put into GuardLink. We act as your data processor and use the providers below to run the service.
- Supabase
- Database, authentication and file storage. The database is hosted on AWS in the EU (Ireland, eu-west-1).
- Stripe
- Subscription billing and payment processing. Card details go to Stripe and are not stored by us.
- Google Firebase
- Delivery of push notifications to browsers and devices.
- Email delivery provider
- Sending account, billing and report emails.
What we do not claim
- GuardLink does not hold ISO 27001, SOC 2 or Cyber Essentials certification, and is not an SIA Approved Contractor. This page describes how the platform is built, not an independently audited result.
- The activity log is available to platform administrators. Company accounts do not yet have their own searchable audit trail of every operational edit.
To report a security concern or ask about data protection, email support@guardlink.app.
Questions about security? Bring your IT contact to a demo and ask us directly.
Book a demo