Data Processing
How HSEVIA processes customer-controlled information
A concise factual draft describing the processing needed to provide HSEVIA, prepared for professional legal review.
Scope and duration
The subject matter is the processing needed to provide HSEVIA's account, HSE record, document, reporting, support, security and enabled AI functions. Processing continues while customers use the service and afterward only as required by the implemented deletion, operational and backup processes described in the Privacy Notice. No fixed retention or deletion period is promised here.
Customer instructions and responsibilities
Customers control the company and site records, worker information, evidence files and occupational-health information they submit. HSEVIA processes that content to provide the features customers use and according to their actions and instructions in the service. Customers are responsible for lawful collection and use, appropriate notices, permissions and authority. HSEVIA remains responsible for its own service operations and security controls.
People and data categories
Data subjects may include users, employees or workers, contractors and other people whose HSE information is lawfully recorded. Data may include identity, contact, workplace and HSE information, uploaded evidence and potentially sensitive occupational-health information.
Confidentiality and security
Access to customer content is limited through authentication and server-side company, site and role checks. Uploaded files use private storage and authorization-checked routes. Security-relevant administrative events are recorded in a company-scoped audit log. These implemented controls do not represent an external certification or guarantee.
Service providers
The verified architecture uses Vercel for application hosting, Supabase for PostgreSQL and private object storage, Cloudflare R2 for independent object backup, Resend for transactional email, Stripe for billing when enabled and Sentry for error monitoring. An enabled AI feature sends relevant inputs to the configured AI provider; the production provider identity remains a launch confirmation gate.
Requests, export, deletion and security cooperation
HSEVIA supports an allowlisted personal-data export, organization report and Proof Pack exports, and password-confirmed account deletion subject to organization-ownership safeguards. Support and security reporting channels are available for customer requests, suspected incidents and data-isolation concerns. The service can assist using these implemented controls; no impossible audit right or fixed response period is promised.