What IT and procurement usually ask before a pilot: where the data lives, who can see it, what happens when the network drops, and how you leave. Questions this page does not answer: hello@anvilmro.com.
Security & data sheet · last reviewed 2026-10-24
Your records, kept safe and kept yours.
Hosting
Your own instance
- Each customer runs on its own instance: its own application service, database, photo storage and credentials. One shop's records are never in another shop's database.
- Inside an instance, every record also carries its organisation, and every read is filtered by it.
- Hosted on a cloud server in the United States (San Francisco).
Encryption
Encrypted in transit, on the device, in backup
- On the tablet: the app's database is encrypted (SQLCipher, AES-256), with its key held in the device's secure keystore. A copy of the file is unreadable off the device.
- Between tablet, browser and server: every connection is HTTPS, with HSTS, so browsers never fall back to plain HTTP.
- Backups are encrypted on our server before they are uploaded; the storage provider cannot read them.
Records that hold
A saved record is never rewritten
- A change is a new version, with who and when. The earlier version stays, and the database itself refuses to alter or delete it.
- Every sign-in and every administrator action is logged, append-only.
- An issued PDF is kept with a fingerprint (SHA-256), so a copy can be checked against the original.
Backups and recovery
Backed up nightly, off site, locked
- Every night: the database, then the photos, to separate off-site storage.
- Each backup is locked against deletion or change for 30 days, by the storage itself.
- Restores are drilled: a backup is downloaded, restored and checked against live counts. A missed backup or drill raises an alert.
Access
You decide who sees what
- Accounts and roles are set by your administrator; permissions are checked on every request.
- Passwords of 12+ characters, stored only as a one-way hash. Repeated failed sign-ins lock the account; a password change signs out every other session.
- A phone or tablet must be paired to your shop with a one-time code. A lost device is revoked in one click and its app locks.
Offline and sync
No signal, no lost work
- Inspections, readings and photos are saved on the device first. Work carries on with no signal.
- When the signal returns, the device sends what changed; nothing on the server is overwritten.
- Two devices change the same record at once: it is flagged on both, a person checks it, and both versions stay on record.
Your data
Yours to take
- Reports, photos and job data download at any time: PDF, spreadsheet and photo archives.
- If you leave, you get a complete copy of everything your shop recorded. Then it is deleted from the live service, and the last encrypted backups expire within 35 days.
- No advertising, no tracking cookies, no analytics. Your data is never sold.
Watching the service
Monitored, around the clock
- An outside monitor checks the service every few minutes and alerts on an outage.
- Crash reports carry the organisation and device, never a person's name or address.
- Server sign-ins and privileged commands are logged and copied off site.
Assistants
Assistant features: off until you switch them on
- The workflow expert and Ask your shop are switched on per organisation, and are off by default.
- Every change an assistant proposes waits for a person to approve it.
Who else handles data
A small number of service providers support the service: server hosting, encrypted backup storage, crash reporting (no names) and email. The current list, with what each does and where, is available on request. hello@anvilmro.com
Who builds Anvil
Anvil is built and run by its founder, who answers the email above.
Report a problem
Found a security issue? Email hello@anvilmro.com. We will reply, and tell you what we did about it.