UK-hosted. Append-only. Yours.
What we have built, in plain terms. No certifications are claimed here; where a control exists it is described, where it is planned it says so.
Data residency
The database runs in a London (UK) region. Report files and certificates are stored in UK or EU object storage. Email and SMS are sent through providers that process the message content needed to deliver it.
Tenancy
Every row that belongs to a customer carries its organisation. Row-level security in the database — not just in the application — decides what a signed-in user can see, by their membership and role, and optionally by team scope (sites, areas or assets). Organisation A cannot read organisation B, and this is tested automatically on every change.
Append-only records
Readings, raw sensor messages and the audit log can be inserted but never updated or deleted: database triggers refuse the statement and the privileges are revoked from every application role, including the service role, on every monthly partition. Corrections are new rows that reference the original.
Audit log
Changes to rules, assets, devices, sensor assignments, memberships, escalation policies and alert states are written to the audit log by database triggers with the acting user. Acknowledgements made through a one-time link record the contact it was sent to.
Ingest security
Network-server webhooks authenticate with a bearer secret compared in constant time against a stored SHA-256 digest; secrets can be rotated. Payloads are validated, limited to 64 KB, and de-duplicated.
Application security
Sign-in by emailed magic link or password through a managed identity provider. Content-Security-Policy and related headers on every page. Server-side input validation on every form and endpoint. Secrets live only in the hosting platform’s encrypted configuration, never in the repository.
Backups and continuity
Daily managed database backups with point-in-time recovery from the hosting provider. Sensors keep readings during internet outages and resend them when the connection returns.
What we do not do
- We do not sell or share customer data. Anonymised, aggregated statistics may be used to improve the models.
- We do not control refrigeration equipment in the current product. The roadmap for safe load shifting is published on the vision page with its safety rules.
- We do not claim certifications we do not hold.
Reporting a vulnerability
Email security@tempa.ai. We acknowledge within two working days.