Data & security

Storage

Accounts, test responses and reports are stored in a managed PostgreSQL database with our cloud provider inside the EU. Files and generated documents are stored in the same environment.

Access control

The database uses Row Level Security. Each user can access only their own rows; business users access their organisation's data. Administrative access is role-based in a separate role table and requires two-factor authentication.

Authentication

Sign-in uses email and password or a one-time link. Passwords are never stored in clear text. Sessions have a limited lifetime and refresh automatically.

Encryption

All traffic to and from the service uses TLS. Data at rest is encrypted by the cloud provider's storage layer.

Browser security settings

The service sends security headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) and a content security policy limiting which sources may load.

Backup

The database is covered by the cloud provider's automated backups. We do not promise a specific recovery time.

Third-party services

• Cloud platform and database — hosting and storage.
• Stripe — payments. Card details are handled by Stripe and never pass through our servers.
• Language-model provider — generation of report text.
• Email provider — account email and notifications.

Deletion

You can request deletion of your account and data by emailing us. We then delete personal data we are not legally required to retain, such as accounting records.

Incident handling

In the event of a personal data breach that poses a risk to you, we notify the Swedish Authority for Privacy Protection within 72 hours and inform affected users where the law requires it. Suspected vulnerabilities can be reported via the contact page.