1. Overview
Thrivespace holds people's training records, certificates and personal details, so we take looking after them seriously. This page sets out how we protect that data. It describes what we do today, not what we plan to do.
Thrivespace is built and operated by SoTech Studio Ltd, a company registered in England and Wales.
2. Where Thrivespace runs
The Thrivespace app and website are hosted on Vercel. The database, sign-in and uploaded files are hosted on Supabase, in the European Union (Ireland).
We do not run our own servers or data centres. Both providers publish independent security reports, including SOC 2 Type II, and are responsible for the physical security of the buildings and machines our data sits on.
A full list of the companies that process data for us is on our Subprocessors page.
3. Encryption
In transit
Every connection to Thrivespace uses HTTPS, encrypted with TLS 1.2 or higher.
At rest
Your data and uploaded files are encrypted where they are stored, using AES-256. Backups are encrypted in the same way.
4. Keeping organisations apart
Each organisation's data is logically isolated from every other organisation's. The database itself checks every request against rules that only return records belonging to the person's own organisation, so one customer cannot see another customer's data.
5. Sign-in and access
Signing in
People sign in with their email address and a password. Passwords are never stored as written: they are hashed, so not even we can read them. Sign-in sessions use short-lived tokens that are renewed automatically while someone is using the app.
What each person can see
Within your organisation, access is set by access groups that you control. By default people see their own records and managers see the people they manage. You decide who can see everyone, and who can change settings.
Our team
Only named members of our team can view the app as one of your users, and only to help with a support request. Product analytics are paused while they do.
6. Backups
The database is backed up automatically every day. Each backup is kept for 7 days.
7. Monitoring
- Errors in the app are reported to Sentry, in the European Union. These reports leave out people's details, what was typed and cookies.
- The app and its database are checked every 3 minutes from several locations, and the results are shown on our public status page (opens in a new tab).
8. How we build it
- Every change to Thrivespace is made in a pull request and reviewed before it is released.
- The app has automated tests that run before changes are released.
- Changes to the database are written down as migrations, so every change has a record.
9. When you leave
If your organisation stops using Thrivespace, you can ask us for a copy of your data for 30 days afterwards. When you ask us to close your workspace, we delete its data from our systems. Backups that still hold it are replaced within 7 days.
10. If something goes wrong
If we become aware of a breach that affects your data, we will:
- Tell you without undue delay, and within 72 hours of confirming it
- Tell you what happened, what data was affected and what we are doing about it
- Work with you, and with the Information Commissioner's Office where needed
11. Reporting a security issue
If you think you have found a weakness in Thrivespace, please email security@thrivespace.space. Please give us a chance to fix it before telling anyone else. We aim to reply within two working days. Our contact details are also published at /.well-known/security.txt.
12. Changes to this page
We will update this page when the way we protect your data changes. The date at the top shows when it last changed.
13. Contact us
SoTech Studio Ltd
Email: security@thrivespace.space