How the Dynetiq platform protects your operational and customer data.
Edge security
Every page is served with a strict Content-Security-Policy: scripts only from our own origin plus a fresh per-request nonce — no inline-script allowance and no wildcard hosts. Objects are blocked and framing is denied.
HSTS with includeSubDomains and preload, nosniff, a strict referrer policy and a scoped permissions policy on every response.
Rated A+ (110/100, 12/12 tests) by the MDN HTTP Observatory on 3 November 2026.
Zero-trust tenancy isolation
Each customer is a separate workspace. Every tenant table carries its workspace id and a restrictive row-level security policy in PostgreSQL, so a query can only ever return its own workspace's rows — whatever the application asks for.
Row-level security is forced on every table, and privileged database functions re-check the caller's workspace before acting.
Partner firms working on shared jobs see those jobs only; their own workspaces stay separate.
Secrets and privileged access
Service credentials live in Google Secret Manager and integration tokens in server-only database columns; neither is ever sent to browsers.
Server code that needs elevated access filters by the caller's workspace explicitly; browsers use the signed-in user's own session.
Accounts are limited to one active device session, and sensitive staff identity data is encrypted at rest with audited access.
AI with guard-rails
Harlay, the in-app copilot, sees only what the signed-in user can see. It can draft records, but nothing is saved until the user confirms — and then under that user's own permissions.
The model never supplies links or record ids that the app trusts; actions resolve against the user's own data.
Data residency and privacy
The primary database is hosted in the UK (London). Personal data is processed under UK GDPR.
Serial-number OCR on tools runs on the device; images are not sent for recognition.
Field devices
Operatives work offline-first; queued changes are tied to the user and workspace that made them and are discarded if a different account signs in on the device.
Found a vulnerability? Email support@dynetiq.com with the details and we'll work with you on a fix.