Security & Trust
Your training data is your operation: your menu, your people, your standards. Here is exactly how we protect it — in plain English, with no security theater. Every claim below describes how PlateSpec is actually built.
Your company's data is walled off at the database
Every record in PlateSpec belongs to exactly one company, and the database itself — not just our application code — enforces the wall. Postgres Row Level Security checks every single read and write against who's asking, so even a bug in our app can't hand one company's courses, people, or reports to another. Isolation isn't a feature we added; it's the foundation everything sits on.
No passwords, so no passwords to steal
Crew sign in by scanning a QR code and entering a one-time emailed code. Managers get one-tap sign-in links. There is no password database to breach and nothing for your staff to reuse from another site. Login codes expire in 10 minutes and lock after 5 wrong attempts, counted atomically on our servers. And our login screens never reveal whether an email has an account — so attackers can't fish for valid logins.
A tamper-proof record of everything
Every meaningful action — a course fired, a quiz completed, a role changed — is written to an append-only event log. Append-only means exactly that: events are never edited and never deleted, by anyone, including us. When you need to prove who was trained on what and when, the record is the record.
Encrypted in transit and at rest
All traffic to PlateSpec runs over TLS (the padlock in your browser), and data is encrypted at rest on our infrastructure providers. Secrets and admin credentials live only on our servers — the browser side of PlateSpec is treated as untrusted territory and never holds keys.
People see only their slice
Access follows your org chart. A trainer or GM sees their location. A regional sees their region. Owners see everything. Support and change requests are gated to regional level and above, so a well-meaning stranger can't reshape your training. Roles are enforced on the server on every request — not hidden buttons in the interface.
Easy in, easy out — the data is yours
Every roster, report, and completion record exports to CSV, included in the product, no paywall, no professional-services invoice. If you ever leave PlateSpec, you take a complete copy of your data with you and we delete ours on request. We'd rather keep you with a good product than with a locked door.
Who touches your data
PlateSpec runs on a short list of infrastructure providers. We don't sell data, run ads, or share your information with anyone not on this list.
What we don't claim
We haven't completed a SOC 2 audit yet — that certification takes an audit window longer than we've existed, and we'd rather tell you that than wave a vague badge. What we can do today is walk your team through everything on this page, live, at whatever depth you want. Security questions get answered by the people who built the system, not a compliance portal.
Found something?
If you believe you've found a security issue in PlateSpec, email hello@platespec.com with the details. A human reads it the same day, we'll keep you posted while we fix it, and we'll credit you if you want credit. Please don't access data that isn't yours while demonstrating an issue.