Security-first platform

Your signage data, protected at every layer.

Security is not an afterthought at Signplanr. It is foundational to how we design, build, and operate the platform — from database queries to file uploads to user access.

Last reviewed: 25 August 2026

Security principles

Defence in depth

Multiple independent layers of protection, so no single failure compromises your data.

Least privilege

Every user, API call, and system process gets only the access it needs — nothing more.

Secure by default

Security is built into every feature from day one, not bolted on later.

Transparency

Audit trails and clear access controls so you always know who did what.

Data protection

All data encrypted in transit (TLS) and at rest.
Database-level isolation between organisations — no shared data leakage.
Row-level security policies enforce access boundaries at the database layer itself.
File uploads validated beyond file extensions to prevent malicious content.
Strict size limits and type restrictions on all uploads.
User input is validated and sanitised server-side before processing.
Error messages are generic by design — internal details are never exposed to clients.
AI plan analysis runs only when you ask for it: the plan image alone is sent to our AI partner, results are proposals you review before anything is created, and the image is not used to train models.
Events downloaded for offline use are stored in the browser's storage on that device until synced, and removed on sign-out or Clear offline data. Two-factor authentication with backup codes protects accounts if a device is lost.

Access control

Role-based access with owner, admin, member, contractor, and customer user roles. Contractors see only the events and signs they are authorised for; customer users see only the individual signs they have been linked to.
Invitations are email-verified, time-limited, and revocable.
Password strength requirements enforced on all account creation and password changes.
Repeated failed sign-in attempts trigger escalating cooldowns before another attempt is allowed.
Account deactivation takes effect immediately across all sessions.
Optional sign assignment mode restricts contractor visibility to only their assigned work.

Infrastructure & operations

Hosted on Vercel and Supabase — enterprise-grade cloud infrastructure.
Core application data — database, file storage, and application servers — is hosted in Sydney, Australia. Some supporting services (payments, email, analytics, map tiles, AI analysis) are provided by partners outside Australia; the full list is in our Privacy Policy.
HTTPS enforced on all connections.
Rate limiting protects against brute-force and abuse.
Bot and abuse detection on sign-in, sign-up, and password-reset forms.
Content Security Policy, frame and object restrictions, and violation reporting reduce the impact of injected content.
HSTS with preloading ensures browsers always connect over HTTPS.
Redirect URLs validated to prevent open redirect attacks.
Background jobs authenticated with dedicated credentials.
Webhook payloads cryptographically verified before processing.

Audit & accountability

Significant actions are logged with who, what, and when.
Audit trail accessible to organisation admins.
Sign edit history tracks field-level changes over time.
Photo uploads and status changes attributed to individual users.
Superadmin actions are logged and auditable.

Your controls

You stay in charge of who has access and what they can see.

SAML single sign-on

Enterprise organisations can connect their identity provider (Microsoft Entra ID, Okta, and more) so the team logs in with corporate credentials and every sign-in goes through your identity provider.

Two-factor authentication

Protect accounts with authenticator-app 2FA, including backup codes and trusted devices. Business and Enterprise owners can require it for their whole team.

Manage team access

Add, remove, and change roles for organisation members at any time.

Revoke invitations

Cancel pending invitations instantly.

Remove contractors

Revoke contractor access to specific events.

Control visibility

Choose whether contractors see all signs or only their assigned ones.

Export your data

Export events, signs, surveys, and jobs as CSV or PDF, and download photos as a ZIP, whenever you need a copy.

Delete your account

Delete your account yourself from your account page. Your personal details are anonymised.

Security questions?

If you have specific security requirements or questions, we'd love to hear from you. To report a security concern, email contact@signplanr.com.