Where your data lives, who can see it, and what happens if you leave.

Your data, including photos and documents, is stored in Microsoft Azure’s Canadian data centres (Canada Central region, Toronto, with backups replicated to Canada East, Québec City). It is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256).

The database is a managed service with automatic daily backups and point-in-time recovery for the previous 35 days.

Every record belongs to one firm. The separation is enforced by the database itself (row-level security), so a mistake in the application can’t show one firm’s data to another.

Inside your firm, each person only sees what their role allows. Clients see only records you have approved and published, and private fields stay private unless a rule explicitly allows them.

Sign-in is handled by a dedicated identity provider, Microsoft Entra External ID, hosted in Canada. GuardDesk never sees or stores passwords.

Office users can turn on two-step verification, and accounts lock after repeated failed attempts. Guards sign in with a one-time link, so they have no password to share or forget.

The guard app keeps a small local database so it can work without a signal. It is encrypted on the device and cleared once records are synced and no longer needed.

Every action sent from the phone is checked again on the server, so a modified or replayed request can’t create a fake scan.

Photos and files are fingerprinted (SHA-256) when they are captured and keep a chain of custody. Supervisors can share a redacted copy with a client while the original stays sealed.

Assignments, approvals, publications and timesheet adjustments are written to an audit log that cannot be edited.

GuardDesk uses a guard’s location to verify clock-ins and checkpoint scans during a shift. Guards see a plain-language notice explaining this the first time they sign in.

Location history is kept for 90 days and is visible only to your firm’s supervisors and administrators, never to clients unless you publish it.

Your data belongs to you. When you cancel, you can export your records (CSV and PDF, with the original photos and files in a ZIP archive), and we delete your data within 30 days, except where the law requires us to keep it longer.

We don’t hold SOC 2 or ISO 27001 certification yet. If your client sends you a security questionnaire, write to us and we’ll fill in the GuardDesk part with you.