Security
Your security records deserve security too
ProtectThread holds sensitive information about how your premises would respond to an attack. Here is how we look after it.
Field-level encryption
Sensitive free text — procedures, addresses, incident descriptions, drill lessons, measure reasoning and phone numbers — is encrypted with AES-256-GCM before it is written to the database. Database access alone does not reveal it.
Tamper-evident audit log
Every change is recorded in a hash-chained audit log. Each entry includes a fingerprint of the one before it, so a deleted or edited entry breaks the chain and shows up when the log is verified.
Inspector View
Share evidence with an inspector or insurer through a read-only link that expires automatically. You choose how long it lasts when you create it, and the inspector does not need an account.
Two-factor sign-in
Every user can add an authenticator app (TOTP) to their account, so a stolen password alone is not enough to sign in.
Role-based access
Organisation administrators, responsible persons, designated senior individuals, site managers and staff each see only what their role needs. Site managers and staff are limited to the sites they are assigned to.
Hosting and transport
All traffic uses HTTPS with HSTS. Uploaded floor plans are held in private cloud storage and served through short-lived signed links.
How we handle your data
- Your compliance records belong to you. We use them only to provide the service to your organisation.
- We collect only what the product needs: account details, site details and the compliance records you create.
- You can export your records (PDF and an inspection ZIP) at any time.
- If your subscription lapses, your account becomes read-only. We do not delete your records because a payment failed.
- Users can ask for a copy of their personal data, or for it to be erased, from their settings page or by emailing [email protected].
- AI features send only the text needed for the task to our AI provider, and every AI output is labelled as guidance to be checked.
Full details are in our privacy policy.
What we do not claim
ProtectThread is not endorsed by, affiliated with or approved by the Home Office or the Security Industry Authority (SIA). Using it does not make your premises compliant on its own; you remain responsible for meeting the Terrorism (Protection of Premises) Act 2025. We do not currently hold ISO 27001 or similar certification, and we will say so plainly until we do.
Questions or a security concern?
Email [email protected].