Security review
Check who can see the record, who can change it and who can approve it.
Security needs to be assessed against your organisation's actual use. Safety Figure applies company, workplace and role permissions to operational records and distinguishes sensitive documents and approval responsibilities.
Access controls in everyday use
Record and file access is checked against the relevant permissions, including when a document is downloaded. Two-step verification is supported and must be enabled by the user; login rate limiting helps restrict repeated attempts. Organisation administrators need to review assignments and remove access when responsibilities change.
Separate preparation from approval
Permit preparation and approval have separate responsibilities. Relevant operations retain information about the user, time and record involved. These controls do not amount to a claim that every system record is an immutable archive.
Questions to resolve for your deployment
Agree the records being processed, intended users, service providers, hosting and transfer arrangements, retention, backup scope and incident contacts. For camera or AI use, examine the fields or images involved and who may access the outputs. Request evidence specific to the service and scope you are considering.
- Which roles can view, edit, download and approve each record type?
- Which external providers receive data, and for what purpose?
- What are the retention, deletion and backup arrangements?
- What evidence and recovery checks are available for the proposed scope?
Claims and limits
These pages do not claim an ISO 27001 certificate, a completed independent penetration test or unconditional legal compliance. Account closure does not mean immediate deletion of every active record, backup and provider copy. Retention and deletion need to be agreed for the relevant data and obligations.