Trust and security
Siteplume keeps the contract record a dispute may turn on. These are the measures in the product today.
Authenticator codes with recovery codes; an organisation can require it of every member who signs in with a password.
OpenID Connect or SAML with your identity provider, and SCIM to add and remove people from your directory.
What each person sees and does follows their role under the contract; letters, documents and meetings can be kept to the client side or named parties.
Each person sees where they are signed in and signs out one device or all of them; an administrator can lock an account at once.
Every change is recorded with who, when and what; the entries are chained by hash, so an edit or a removal shows.
A project under hold refuses every deletion and removal, whoever asks, until a director lifts it.
A copy of the whole record with its media, stored with its SHA-256 and locked until the retention date; taken automatically when a project closes.
Checking the latest backup…
HTTPS everywhere; files stored encrypted by the storage provider; passwords and tokens stored only as hashes.
AI answers only from what the asker may open, cites its sources, and the provider does not train on your data. The operator can leave AI switched off.
Running the service
An uptime check from outside the service runs every ten minutes and the service checks itself every five; errors, stalled background work and a missed backup reach the operator by email. The status page shows the last 30 days. Dependencies are audited and the code is scanned for leaked credentials on every change.
Reporting a vulnerability
If you find a security problem, tell us through the contact page with the steps to reproduce it. Please do not test against other customers' data, do not degrade the service, and give us a reasonable time to fix it before telling others. We reply to every report.
See also the subprocessors, the data processing summary and the service status.