Security and data
We cannot read your log.
What that means in practice
Vantra staff have no standing access to customer event records. Support access has to be requested with a reason, approved by someone at the customer with the authority to grant it, and it expires on its own — there is no permanent key.
While an access window is open, a persistent banner is shown to the customer's team inside the product naming the person, the reason and the expiry. Every screen viewed during the window is written to the audit trail, and the customer can read that trail. Vantra cannot edit it.
The four rules
- Requested with a reason, never assumed.
- Approved by the customer, not by us.
- Visible to their team while it is open.
- Expires automatically and is logged in full.
How records are protected
An event log is only evidence if it cannot be quietly rewritten
- Append-only is enforced in the database, not in the interface. There is no update or delete policy on log entries or on the audit trail, and those permissions are revoked at SQL level — an application bug cannot rewrite a record because the database will not accept the write.
- A correction is an attributed addition. The amendment names who made it and when, sits under the original in time order, and the original text stays exactly as it was written.
- The audit trail is hash-chained: every row carries the hash of the one before it, so removing or altering a row breaks the chain. Daily anchors are held outside the database, which makes tampering detectable rather than merely prohibited.
- Closing an event locks its log permanently. Nobody can edit it after that point, including Vantra.
- Every entry carries both times — when it happened and when it was logged — because the gap between them is the first thing an investigator asks about.
Access control
Who can see what, decided in the database
- Role-based access enforced at row level in the database, so a query from any client returns only what that person is entitled to see.
- Five company roles — owner, administrator, manager, controller and viewer — plus per-event assignment, so a controller booked on one event does not see another.
- Owners are required to hold a second factor. Sessions expire and can be revoked centrally.
- Scoped device links for field use: a tablet at the ejections tent can create records and read nothing. Links are time-limited, rate-limited and revocable from the controller's screen.
- Officers identify themselves on a shared device with a PIN or SIA number, so attribution survives a device that four people use in one night.
Where data lives
United Kingdom
- Event records, staff records and account data are held in the United Kingdom.
- Encrypted in transit with TLS 1.2 or better, and at rest with AES-256 at the storage layer.
- Backups taken continuously with point-in-time recovery over a seven-day window, plus daily snapshots retained for 30 days.
- Restores are tested quarterly against a scratch project, and the test is recorded.
- Uploaded photographs and documents sit in private storage. Every download is a signed, expiring link tied to the person requesting it.
Who else is involved
3 sub-processors, listed by name
- Supabase — Managed Postgres database, authentication and file storage. Holds event records, staff records and account data. (United Kingdom (London region))
- Cloudflare — Application hosting, edge delivery and DNS. Processes requests in transit; does not store event records. (United Kingdom edge, with global routing)
- Resend — Transactional email: sign-in links, screening invitations, shift offers and exported reports sent by a customer. (European Union and United States)
Retention and deletion
Keep it as long as your licence requires, and no longer
- Retention is configurable per record type — log entries, staff records, screening packs, photographs and audit rows are separate settings, because they do not share a sensible lifetime.
- Deletion runs automatically at the end of the period and produces a report of what was removed, so there is evidence the policy was applied.
- A legal hold suspends deletion for an event or a person until it is lifted.
- Full export at any time, in open formats: Excel and CSV for records, PDF for documents, JSON for the audit trail. There is no export fee and no notice period. If you leave, you take everything.
Availability and incidents
What we will commit to, and what we won't
- The product is built to keep working when the connection does not. Entries are written to the device first and synchronised when the network returns, so a control room in a field is never blocked by a mast.
- Target availability is 99.5% monthly for the hosted service, measured excluding announced maintenance. We are a small company and will not publish a number we cannot hold.
- Maintenance that requires downtime is announced at least five working days ahead and scheduled outside UK event hours where possible.
- Incidents affecting availability or data are posted to the status page within one hour of detection, updated at least every four hours until resolved, and followed by a written account of what happened.
- A personal data breach affecting a customer's data is reported to that customer without undue delay and in any event within 24 hours of confirmation, so they can meet their own 72-hour duty to the ICO.
Availability commitments above the published target are agreed in writing, per contract, and only where we can actually meet them.
Responsible disclosure
Found something? Tell us.
Email security@vantra-uk.com with enough detail to reproduce the issue. We acknowledge within two working days, tell you what we found within ten, and let you know when it is fixed.
Please do not access, alter or retain anyone else's data while testing, do not run denial-of-service or social engineering against our customers, and give us a reasonable period to fix an issue before publishing it. We will not pursue legal action against anyone who reports in good faith under those terms. There is no paid bounty; there is a genuine thank you and credit if you want it.
Documents
The pack a procurement team asks for
- Pre-completed security questionnaire — the common questions, already answered.
- Data processing agreement — readable and downloadable before you sign anything.
- Sub-processor list — who they are, what they do, where they process.
- Privacy policy — for visitors and for people who appear in an event record.
What we do not claim
Vantra is not certified to ISO 27001 or SOC 2, and there is no such badge on this page. "GDPR compliant" is not a certification and we do not use it as one. The page describes what the product does; where an obligation is yours as controller, the data processing agreement says so plainly.
Send us your security questions
If your review needs something that is not on this page, ask. We would rather answer it in writing than have it guessed at.