Data & security

Where your data is stored

Accounts, customer records, inspection data and images are held in a Supabase project in the Sydney region (ap-southeast-2), daily backup copies of thermal images, visual images and generated report PDFs are held by Amazon Web Services in Sydney, and the website and report engine are hosted in Sydney. Some data does go overseas, only in the circumstances the Privacy policy describes:

• AI drafting: a capture's images and readings go to Anthropic in the United States, whether drafting was turned on at the camera, started by itself when you opened an inspection on the web, or requested by you. If your account admin has turned AI drafting off for your business, nothing is sent to Anthropic for drafting.
• Support email: every email you send to support@switchreport.app is also sent to Anthropic in the United States to help us triage and draft a reply. This applies automatically to every message, not just ones you opt into, and turning AI drafting off does not change it.
• Email: our business email (including privacy requests and support email), automated account emails such as password resets, and the alert email a manually submitted problem report generates all go through Google in the United States.
• Card payments on paid plans, processed by Stripe in the United States.
• Our own records: contact details and notes on our dealings with you are kept in Capsule in the United Kingdom, and billing records in Xero in the United States.

Our service monitoring also runs outside Australia, and it is designed to carry no personal information. A monitoring server we run in Singapore checks every 15 minutes that SwitchReport is working. It receives performance figures and short error excerpts from the report engine's log. Those excerpts are cleaned in Sydney before they leave: account and record identifiers, IP addresses, email addresses, sign-in tokens, file names, quoted text and the paths of web addresses are replaced with placeholders. When a check fails, the monitor sends the failed checks' details and those cleaned excerpts to Anthropic in the United States, whose AI writes a plain-English diagnosis for our own alert email.

Nothing else is moved offshore for processing.

Encrypted in transit

All traffic to switchreport.app uses HTTPS. Plain HTTP requests are redirected, and the .app domain is on browsers' HTTPS-only preload list, so mainstream browsers will not attempt an unencrypted connection.

One account cannot see another's data

Separation between accounts is enforced in the database using row-level security, not only in the application. Every record carries its owner, and the database refuses to return or accept rows belonging to anyone else. Stored images are similarly partitioned per account. Because the check is in the database, a fault in the website or camera app cannot on its own expose another customer's records. A small number of our own server-side operations run with elevated access (account sign-up, seat invitations, support alerts, AI usage metering, account deletion); we limit and review those.

Accounts

You can sign up online from our Plans page, and team members join when their account admin invites them. Passwords are stored hashed by our authentication provider and are never visible to us. Sign-in attempts are rate limited, and authentication events are logged so misuse can be investigated.

On the camera

The app stores its working data in the device's protected app storage, which other apps cannot read. Saved sign-in credentials are encrypted using the device's hardware-backed keystore. Builds we release are hardened so the app's data cannot be extracted over a USB cable.

Signing out erases the app's data from the camera, and warns you first if anything has not yet been uploaded. Saving copies to the FLIR Gallery, the camera's own picture gallery, is off by default and only happens if you turn it on in the app. If you do, those copies are deliberately left in place as your own backup when you sign out: see the Privacy policy for what that means if a camera is shared or passed on.

The FLIR camera's screen lock passcode protects those FLIR Gallery copies on the camera: the images and the details stored in them are available there only to people who can unlock it. Keep the passcode private, because anyone you give it to, including colleagues who share the camera, can see them. Once a file is copied off the camera, the screen lock no longer protects it. If you turn on FLIR's own cloud service, FLIR Gallery images upload to FLIR's cloud under your own FLIR account, where FLIR's terms and privacy policy apply.

Backups

The database holding your account, customer, site and inspection records is backed up daily. Thermal images, visual images and generated report PDFs are also copied daily, filed under system identifiers, to Amazon Web Services in Sydney, Australia. Image files in that backup that came from the camera carry the details the camera stores inside them, including any earlier versions of those details, as the Privacy policy explains. The report PDFs name the site and customer as the report does. Backup copies of records and files you delete are removed within 30 days.

No third-party code on our pages

Everything the website loads — fonts, scripts, styles — is served from our own site. The typefaces are self-hosted, and the database library is a pinned, exact-version copy kept in our own tree with its checksum recorded, rather than a live download from a third-party CDN. Loading a page sends nothing to anyone except us and the service providers named in the Privacy policy, and no third-party CDN can change the code that runs on the page holding your session.

AI drafting

SwitchReport can draft the condition observation, the component identification, the board description and the wording for an absolute-maximum reading. AI drafting is a Plus feature, and nothing is sent for drafting from a Core plan. On the camera, turning AI on for an inspection sends every capture in it for drafting once the inspection reaches the web. On the web, drafting starts by itself when you open a completed inspection, for every capture that does not have a draft yet, whether or not AI was turned on for it at the camera. The setting "Draft AI notes automatically when I open an inspection" in Account settings turns this off. It is on unless you turn it off, and it applies only in the browser where you set it. With it off, nothing is sent from the web until you ask for a draft. You can stop drafting for an inspection at any time. Your account admin can turn AI drafting off for everyone in your business, in Account settings, and only the account admin can change it. Once it is off, our server refuses every drafting request from your business before anything is sent to Anthropic, even for an inspection that had AI turned on at the camera. Requests already sent still finish, and drafts already made are kept. A request carries, at most, that capture's thermal image and visual photo, the panel name you typed, the readings and priority details, the comparison method and the re-inspection date, not your customer records. The images are re-created before they are sent, so the details the camera stores inside the image file (such as the location and system identifiers, plus the customer, site and thermographer names in files from earlier versions of the app) are not included. An image can still show whatever was in frame when it was taken, and you decide what you capture and whether it is sent for drafting. Every request is logged against your account, and what the assistant drafted (and what you did with it) is recorded so reports stay auditable. The details, including the overseas processing involved, are in the Privacy policy.

What we do not do

• We do not sell, rent or trade your data, or your customers' data.
• We do not use advertising or tracking pixels on the signed-in application.
• We do not use your inspection images for any purpose other than producing your reports.
• We do not store payment card numbers — card payments are processed by Stripe.

If something goes wrong

If a data breach occurs that is likely to result in serious harm, we will assess it promptly — within 30 days of suspecting an eligible breach — and notify the Office of the Australian Information Commissioner and the people affected as soon as practicable, under the Notifiable Data Breaches scheme. The commitment is made formally in the Privacy policy.

Reporting a security problem

If you believe you have found a security issue in SwitchReport, please tell us at support@switchreport.app before disclosing it publicly. We will acknowledge you promptly and keep you informed while we fix it. We will not pursue anyone who reports a genuine issue to us in good faith.