Security
How we look after your records
Datesly holds licence numbers, expiry dates and copies of cards for your staff and subcontractors. Here is exactly how that information is stored and protected. Everything on this page describes how Datesly works today.
Data stays in Australia
- Your records and uploaded files are stored in Sydney, Australia, on Supabase (AWS ap-southeast-2).
- Our application servers also run in Sydney, so your data does not travel offshore to be processed.
Encrypted in transit and at rest
- Every page and file is served over HTTPS (TLS). Connections from our servers to the database are encrypted too.
- The database and file storage are encrypted at rest by Supabase using AES-256.
Only your business sees your records
- Every request checks your sign-in and only returns records that belong to your business.
- Row level security is switched on for every database table, with no public access, so the database cannot be read from outside our servers.
- Uploaded licences and certificates sit in private storage and are only served to a signed-in member of the business that owns them.
- Worker upload links are unique and unguessable, only add documents to that one worker, and close after 14 days or when the worker taps Finished. Every upload waits for your approval before it counts or replaces a record.
Sign-in protection
- Passwords are stored only as a salted scrypt hash. We cannot read them.
- Emailed sign-in links work once and expire.
- The session cookie is HTTP-only and sent only over secure connections.
- The public demo uses separate sample data and is read-only.
A record of what happened
- Each verification records who checked, when, which official source was used and the result.
- Every reminder and worker email is logged with the recipient, the time sent and the delivery reference.
- Documents keep when they were added and last updated, and ABN checks keep the date of the last check.
- The compliance report shows who is current, expiring or expired when a client or auditor asks.
Your data, your copy
- Export your people and documents to CSV at any time, on every plan.
- Cancel and you keep read access to what you entered. Ask us to close the account and we delete your records within 30 days.
Payments
- Card payments are handled by Stripe. Card numbers never reach Datesly’s servers and we never store them.
Certifications
Datesly itself does not hold a SOC 2 or ISO 27001 certification. We build on providers that do: Supabase (SOC 2 Type 2) for the database and file storage, Vercel (SOC 2 Type 2 and ISO 27001) for hosting, and Stripe (PCI DSS Level 1) for payments.
Report a security concern
If you think you have found a security issue, or you are worried about your account, email datesly.alerts@outlook.com and we will look at it straight away. More on how we handle personal information is in our privacy policy.