VANTRABack to the site

Legal · last updated August 2026

Security questionnaire

These are the questions we are asked most often by compliance and procurement teams, answered in advance. If your review needs something that is not here, email security@vantra-uk.com and we will answer it in writing.

The company

  • Who are we contracting with?
    Vantra, operating from the United Kingdom. The registered company details are shown in the footer of every page and on the contact page.
  • How many people have access to production systems?
    A very small number, and access is named rather than shared. Production access is used for maintenance, not for reading customer records — support access to a customer's event data is a separate, customer-approved and time-limited mechanism.
  • Do you hold ISO 27001, SOC 2 or Cyber Essentials?
    Not at present. We do not display badges we have not earned. Where a certification is a hard requirement for your procurement, tell us and we will say honestly whether we can meet the timescale.

Hosting and data location

  • Where is customer data stored?
    Event records, staff records and account data are held in the United Kingdom. Transactional email is processed in the EU and US by our email provider; the sub-processor list states this.
  • Is data encrypted in transit and at rest?
    Yes. TLS 1.2 or better in transit, AES-256 at rest at the storage layer. Uploaded photographs and documents sit in private storage and are served through signed, expiring links.
  • Is customer data segregated?
    Yes, logically. Every row carries the owning company, and row-level security policies in the database scope every query to the requesting user's company and event assignments.

Access and authentication

  • How is access controlled?
    Role-based, enforced at row level in the database rather than in the interface. Five company roles plus per-event assignment. Scoped device links used in the field can create records and read nothing.
  • Is multi-factor authentication available?
    Yes. Time-based one-time codes, and it is required for account owners.
  • Can we use single sign-on?
    SAML single sign-on is available on the enterprise plan.
  • How quickly can access be revoked?
    Immediately, by an owner or administrator from within the product. Sessions are ended and device links are revoked at the same time.

The record itself

  • Can a log entry be edited or deleted?
    No. Append-only is enforced by the database: there is no update or delete policy on log entries or the audit trail and those permissions are revoked at SQL level. Corrections are attributed amendments recorded alongside the original.
  • Is there an audit trail, and can it be tampered with?
    Every change is written by database triggers rather than application code, and rows are hash-chained so that removal or alteration breaks the chain. Daily anchors are held outside the database.
  • Can the customer read the audit trail?
    Yes, from inside the product, and export it as JSON.

Retention, deletion and exit

  • How long is data kept?
    For as long as the customer configures, per record type. Deletion runs automatically at the end of the period and produces a report of what was removed. A legal hold suspends deletion.
  • What happens if we leave?
    Full export in open formats at any time — Excel and CSV for records, PDF for documents, JSON for the audit trail. On termination, data is deleted within 30 days of the customer confirming they have their export, or sooner on request.
  • Do you use customer data for anything else?
    No. Customer event data is not used to train models, is not sold, and is not shared other than with the sub-processors listed publicly.

Availability and incidents

  • What is the availability target?
    99.5% monthly for the hosted service, excluding announced maintenance. The product also works offline on the device, so a network failure at a site does not stop a control room logging.
  • How are incidents communicated?
    Posted to the status page within one hour of detection and updated at least every four hours until resolved, followed by a written account. A personal data breach affecting a customer is reported to them within 24 hours of confirmation.
  • What are your backup and recovery arrangements?
    Continuous backup with point-in-time recovery over seven days, daily snapshots retained for 30 days, and restore tests carried out quarterly and recorded.

Using this document

This page is maintained by Vantra and describes current operating practice. It is not an independent audit and does not claim certification. Print it to PDF for your records — the print stylesheet renders it as black ink on white paper.