Security
Last updated: 2026-10-15
Security is foundational to trust. We take a layered approach to protecting customer data and platform integrity. This page describes what we do today and what we are working towards.
Infrastructure
Hosting
- Database, authentication, file storage and server functions: Supabase in the EU region (Frankfurt, Germany)
- Website and app: Vercel, in the EU region (Frankfurt, Germany) where available
- All data at rest encrypted with AES-256
- All data in transit uses TLS (encrypted connection)
Backups
- Automated daily backups via Supabase
Network
- HTTPS-only across all endpoints
- HSTS enforced
- DDoS protection via the infrastructure of our hosting partners
Access and authentication
- Role-based access control: within a company, access depends on the role (admin, manager, regional manager, team lead, cleaner)
- Least privilege principle: each role sees only what it needs
- SSO is possible on the Custom plan, as a custom arrangement
- Sign-in with Google or Apple may be offered as an option
- Password policy: minimum 8 characters, with at least one uppercase letter, one lowercase letter and one digit; passwords that appear in known data breaches are refused; passwords are stored hashed
- Session management with secure session tokens, automatic expiry
Data protection
- Multi-tenant architecture: each company’s data is strictly separated at database level (row-level security per company)
- Audit logs: changes to hours, access and roles, company data and several other areas are recorded in a log that users cannot change or delete from within the app
- Geographic limitation: primary processing within the EU
- Data export on demand for active customers
- 30-day export window after termination
- Hard deletion within 90 days after termination (subject to legal retention periods)
Operations
- Vulnerability monitoring via continuous scanning and dependency updates
- Incident response procedure for following up and reporting incidents
- Personnel obligations: all team members are bound by confidentiality
- Subprocessor management: every subprocessor goes through due diligence
Compliance
- GDPR compliant: our Privacy Policy and DPA reflect EU regulations
- 2027 Belgian time tracking: our platform is designed for the upcoming requirements
- GDPR data subject rights supported via the platform
- ISO 27001 and SOC 2 are on our roadmap
Report a security issue
Email security@cleaniro.com. We acknowledge within 48 hours. Please do not make issues public before we have had a reasonable opportunity to address them.