Your staff's positions never leave the installation. There is no one to send them to.
It is the question that stalls a geolocation rollout in front of the works council, and the one IT asks before signing off. Here is the design, described in enough detail for you to judge it yourself.
It is not a processing policy. There is simply no recipient.
The platform is hosted on OVHcloud, in data centres located in the European Union. Routing, optimisation and the base map run inside the installation, so staff positions and calculated routes are not sent to any third party. There is no external map provider to query them.
On that foundation sits the rest of this page: permissions in four layers, isolation per organisation, files behind expiring signed URLs and automatic telemetry retention. It is all in the published functional documentation, which you can read before signing anything.
Article 90 of the LOPDGDD (Spain's data protection law) is built into the table design.
Not tucked into a footnote of the contract.
- Versioned consent Each tracking session opens against a specific version of the consent, which is recorded.
- Bounded sessions With an explicit start and end, not permanent tracking.
- Rejection outside working hours Points received outside effective working hours are discarded on the server. They are not stored and filtered later: they never get in.
- Automatic 60-day retention On monthly partitions, with purging handled by the system itself.
- Personal data erasure A dedicated endpoint to handle an erasure request.
In a negotiation with the works council this stops being a technical detail and becomes what unblocks the rollout.
52 permission codes, resolved in four layers.
The catalogue covers fourteen modules — maintenance, assets, inventory, personnel, branches, customers, sectors, portal, meters, SLA, reports, configuration and fleet — each with its view, create, edit and delete verbs plus its own specific ones.
On top of that catalogue sit six immutable system roles, custom roles each organisation defines, and per-user exceptions for the cases that fit no role. Nobody needs a bespoke role just for one exception.
- Three separate identities Internal user, customer portal user and API key. Each with its own table, access flow and session lifecycle. They never mix.
- One session per surface Signing in from another browser invalidates the previous session with an explicit message. Web and mobile are controlled separately, so signing in on the phone does not log you out of the web.
- Passwords hashed with Argon2 And a JWT delivered in an httpOnly cookie, never reachable from JavaScript.
- Multi-tenant isolation Each organisation operates in an isolated environment with its own hierarchy of customers, assets, personnel, inventory and configuration.
Photographs are not guessable URLs.
Photographic evidence, asset documents and signatures are served with JWT and expiring signed URLs. And the API keeps an allowed hosts list.
What the technician proposes goes through approval.
New assets, property corrections and geometry changes proposed from the phone come in as change requests with an approval flow. The technician's finding is not lost, and the inventory does not degrade because of it.
Getting in is easy. So is getting out, and that is in writing.
The real risk of a CMMS is not signing up but being unable to leave: the inventory that took a year to load, the work order history and the photographs of every job, trapped in a format only the vendor understands. These are the commitments we sign in the contract.
| Commitment | What it means for you |
|---|---|
| Your data is yours | No licence over it and no use for other purposes. We process it on your behalf. |
| Full export, always | An endpoint delivers assets, work orders, incidents and photographs in a ZIP with a manifest and geometries in GeoJSON. No need to ask us or pay extra. |
| 90 days to leave without rushing | When the contract ends you keep read access and export for that period, at no cost. |
| Formats anyone can read | The export comes in open, documented formats, with a manifest that explains each file. Any GIS-capable system can load it without depending on us. |
| Certified deletion | When you ask, or when the exit period ends, we delete your data and give you a certificate. |
| Six months' notice | If the service is ever discontinued, you will know six months in advance and the system keeps working in the meantime. The 90-day exit period starts after that. |
| No lock-in period | Monthly billing. Leave whenever you want. |
All of the above is a contract annex, not a policy that can change without telling you.
Last updated:
Next: how data flows out to your systems.
And if your security lead has questions this page does not answer, they can put them directly to the people who build the product.