A server in London
The app, its database and your photos, videos and records run on a server in London that we manage ourselves.
Security and your data
Your guides, photos and sign-off records belong to your company. This page explains where they're kept and how we look after them, in plain words. The data processing agreement sets out the detail.
Where your content lives
Nightly backups
Your content is backed up every night to a separate location and kept for 7 days.
Only what's needed on the phone
Workers' phones and tablets keep only what they need to open guides offline. Sign-offs made offline are sent to the server as soon as the device is back online.
How we keep it safe
Your content is kept apart
Every guide, file and record is tied to your account, and the service checks that link on every request, so another customer can't see or change it. Guides are never shared between customers.
Encrypted on the way
Everything between a phone, tablet or computer and our server travels over an encrypted connection.
You choose who does what
You decide who can write and publish guides, who approves them and who sees the reports. Workers only see published guides.
Few people, logged access
Only named people who need it can reach our production systems. They sign in with multi-factor authentication and their access is logged. We look at your content only when you ask for support, to keep the service secure, or when the law requires it.
Kept up to date
We apply security updates promptly and watch the software we depend on for known weaknesses.
Cyber Essentials
BHIK Studios Ltd, the company behind Subtilitas, holds Cyber Essentials certification, the UK government-backed scheme for protecting against common cyber attacks.
The companies that help us run it
Three companies process data for us. The full list, with the safeguard for each, is in annex 3 of the data processing agreement.
| Company | What it does |
|---|---|
| DigitalOcean | The London server that runs the app, its database and files |
| Nightly backups, kept for 7 days | |
| Cloudflare | Network, DNS and security for subtilitas.app |
Questions from IT and procurement
Something else on your checklist? Email [email protected] and we'll answer it in writing.
Do you have a data processing agreement?
Yes, and it's published on this site, so you can read it before you sign up. It covers Article 28 of the UK GDPR, the sub-processors and what happens to your content at the end.
Does this website track visitors?
No. This site sets no cookies and loads nothing from other companies, so there's no cookie banner to click through.
Who owns the guides we write?
You do. Your guides, photos, videos and records are your content, and we use them only to run Subtilitas for you.
Try it on one machine for 30 days
You don't need a card, and you can read every policy before you start.