Security Policy

At MECH Inspect, security is foundational to everything we build. This document outlines our security practices, infrastructure protections, and your responsibilities as a user of our Service.

Infrastructure Security

• Cloud hosting with enterprise-grade security (Supabase, backed by AWS); primary data region: Europe (London), United Kingdom
• Encrypted connections in transit (TLS) for all database and API traffic
• Provider-managed network isolation and firewall protection
• Regular security patches and dependency updates

Authentication & Access Control

• Strong password requirements (minimum 8 characters with at least one uppercase letter, one number, and one special character)
• Optional Multi-Factor Authentication (TOTP-based 2FA)
• Secure session management with automatic expiration
• Role-based access control (Owner, Admin, Technician, Super Admin)
• Per-device login tracking and the ability to revoke recognized devices

Data Protection

• Row Level Security (RLS) enforced on all tables
• Organization-scoped data isolation
• Temporary 48-hour caching of diagnostic lookups
• Vehicle history data from third-party providers deleted within 24 hours
• Service-history and repair-order analytics data retained on a defined schedule and automatically aged out
• No storage of customer PII (names, addresses, payment cards)

Monitoring & Activity Logging

• Audit logging of authentication and account-management events (login, failed login, password change, MFA enable/disable)
• Login rate limiting to deter brute-force attempts
• Per-user login history and recognized-device list available in account settings
• Admin-accessible activity logs for after-the-fact review

Third-Party Security

We carefully select service providers who meet rigorous security and compliance standards:

Data Breach Notification

If we determine that a personal data breach affecting your information has occurred, we will notify you and any required regulatory authorities consistent with the timelines and content requirements below.

• Timing: We will notify affected users and required regulators without undue delay, and in any case within 72 hours of becoming aware of a personal data breach where required by applicable law (such as Article 33 of the EU General Data Protection Regulation). Where US state breach-notification statutes apply, we will provide notice within the time frame required by the relevant state law (typically 30 to 60 days).
• Method: Where direct individual notice is required, we will use the email address associated with your account. If your contact information is unavailable or notice by email is not feasible, we may provide substitute notice as permitted by applicable law (for example, conspicuous posting on our website, or notice to major statewide media).
• Content: Notification will include, to the extent known at the time of notice: the nature of the breach; the categories and approximate number of individuals affected; the categories and approximate volume of personal data records concerned; the likely consequences of the breach; the measures we have taken or propose to take to address the breach and mitigate possible adverse effects; and contact information for follow-up questions.
• Regulators: Where law requires, we will notify the relevant regulator (e.g., a state Attorney General, an EU supervisory authority) within the time frame mandated by that law.

Your Security Responsibilities

Security is a shared responsibility. As a user of our Service, you agree to:

• Use strong, unique passwords for your account
• Enable Multi-Factor Authentication when available
• Keep your login credentials confidential
• Report suspected security incidents immediately
• Do not input customer PII into the Service
• Use the Service only from secure, trusted networks

Vulnerability Reporting

We appreciate the security research community's efforts in helping us keep our Service secure. If you discover a security vulnerability, please report it responsibly:

Report security vulnerabilities to: Security Team

Please include a detailed description of the vulnerability, steps to reproduce, and any supporting evidence. We will acknowledge receipt within 48 hours and work to address valid reports promptly.

Compliance & Standards

Our security practices are designed to align with industry standards and regulatory requirements:

• OWASP Top 10: We actively protect against common web application vulnerabilities
• GDPR Alignment: Data handling practices support GDPR requirements for EU users
• CCPA Compliance: We honor California consumer privacy rights
• Vendor SOC 2: Our infrastructure providers maintain SOC 2 certification

Contact Us

For security-related inquiries or to report a concern:

Security Issues: Contact Security Team

Privacy Inquiries: Contact Privacy Team

General Support: Contact Support