Security & Trust

Last updated: 21 September 2026

GoReportIt is a multi-tenant ticketing service used by organisations to handle operational issues and the people who report them. Security is not a feature bolted on the side: tenant isolation, encryption and access control are built into how the product works. This page summarises the measures in place. For our data-processing details and your rights, see the privacy policy.

Encryption

• In transit: all traffic uses HTTPS with TLS 1.3 and a 256-bit cipher (AES-256-GCM). HSTS is enforced, and our Content-Security -Policy blocks inline scripts.
• At rest: all data, including the database and file attachments, is encrypted at rest with AES-256.

Where your data lives

Production data is hosted in the European Union (Frankfurt, Germany). GoReportIt runs on SOC 2 Type II and ISO 27001 certified infrastructure provided by Render. Where personal data is transferred outside the EEA or UK, it is covered by Standard Contractual Clauses, the EU-US Data Privacy Framework and the UK Addendum through our hosting provider's data-processing agreement.

Tenant isolation

Each customer organisation runs in its own isolated workspace. Data from one workspace is never visible to another: every request is scoped to the active workspace at the data layer, and this boundary is covered by an automated isolation test suite that runs on every change.

Authentication and access

• Two-factor authentication (TOTP with recovery codes) is available to every user and mandatory for platform operators.
• Passwords are hashed, screened against the Have I Been Pwned breach corpus, and never stored in plain text. Changing a password or a 2FA setting signs out every existing session.
• Role-based access within a workspace (reporter, agent, admin), with least-privilege defaults and optional per-category limits for staff.
• Sign-in is rate-limited with per-account lockout to blunt brute-force attempts.

Monitoring and resilience

• An authentication and account audit log records logins, lockouts, password resets and 2FA changes, with defined retention.
• Security-relevant events (account lockouts, new operator accounts, two-factor being disabled) alert our operators automatically.
• Encrypted daily backups with point-in-time recovery on the database.

Secure development

Changes are peer-reviewed, run through an automated test suite (including cross-tenant isolation checks) and a dependency vulnerability scan on every push before they reach production. Dependencies are pinned and updated deliberately.

Responsible disclosure

If you believe you have found a security vulnerability in GoReportIt, please email security@goreportit.com. We welcome good-faith reports, will acknowledge them, and ask that you give us a reasonable chance to fix an issue before disclosing it publicly. A machine-readable contact is published at /.well-known/security.txt.

Sub-processors

We use a small number of vetted service providers to run GoReportIt, each under a data-processing agreement. The current list is in our privacy policy.

Documentation for buyers

For a security review or vendor assessment, we can share our security pack, including our hosting provider's SOC 2 Type II report and Data Processing Agreement, on request under a mutual non-disclosure agreement. Email security@goreportit.com to request it.

No system can promise absolute security, but we work continuously to protect your data with the measures above and to improve them over time.