Trust

Security & data handling

RampWorks holds maintenance records that safety and compliance decisions are made from. This page describes the controls that protect them, in plain terms.

Authentication

  • Username and password sign-in; there is no public self-registration
  • Passwords stored as bcrypt hashes, never in recoverable form
  • Signed JWT sessions with a configurable lifetime
  • A sign-in guard that requires additional verification after repeated failed attempts
  • Self-service password change, and administrator-initiated reset

Authorisation

  • Role-based module access, defined per workspace
  • Station scoping applied to every record a user can reach
  • Service-provider scoping narrowing contractor accounts to their own company
  • Account creation and password reset reserved for Super Admin
  • Authorisation enforced in the API, not only in the interface

Transport and browser hardening

  • HTTPS only, with HSTS
  • A content security policy that permits no inline scripts
  • Framing denied, MIME sniffing disabled, referrer policy restricted
  • Cross-origin isolation headers on the application
  • Sensitive responses marked no-store so shared caches cannot retain them

Traceability

  • Work-order status changes retained as audit history
  • Checklist library changes recorded with actor and timestamp
  • Submitted-by and edited-by attribution on operational entries
  • Stock movements recorded rather than counts silently overwritten
  • Optimistic concurrency on work orders, so simultaneous edits cannot overwrite each other unnoticed

Build pipeline

Scanned before it ships, and after it lands

Security checks run as a gate in the release pipeline rather than as a periodic audit. A build that fails the gate does not become the deployed image.

  1. 01

    Secret detection

    Every build is scanned for credentials committed by mistake.

  2. 02

    Dependency and vulnerability analysis

    Go module vulnerabilities and web dependency advisories are checked on each build.

  3. 03

    Static analysis

    Source is analysed for known insecure patterns before an image is produced.

  4. 04

    Container scanning

    The built image is scanned, and a failing scan leaves the previous known-good image in place.

  5. 05

    Software bill of materials

    Each build produces a CycloneDX SBOM of what went into the image.

  6. 06

    Dynamic scanning

    After deploy, the running application is scanned against the commit that was just built, with a deeper scan on a weekly cycle.

Your data

Straight answers

What data does RampWorks hold?
Account details — name, username, email, role, station access and provider company — plus the operational records your teams create: work orders, assets, stations, refuelling entries, inventory counts, checklist results, notes and technician signatures where a job requires acknowledgement.
What is it used for?
Authenticating users, applying role-based access, running maintenance and inspection workflows, retaining operational history and generating reports for station and fleet management. Nothing else.
Is data sold or shared?
No. RampWorks does not sell personal data. Information is visible inside the workspace to the people your administrators have granted the relevant permissions to.
Who can see a given record?
Only accounts whose role grants the module and whose station scope includes the record — and, for contractor accounts, only work rolled out to their own provider company.
How is it backed up?
Database backups run on a nightly schedule, with a documented restore procedure. Backup retention can be aligned to your own record-keeping obligations.
How do we get data out?
Every operational module exports to Excel and PDF, and work orders export to CSV as well. Your records remain exportable in open formats for the life of the workspace.

This page describes the controls the platform implements. It is a description, not a contractual warranty; the terms applying to a specific deployment are set out in that organisation's agreement. See also the privacy policy.

Need a security review before you commit?

We can walk your IT or compliance team through the access model, the data held, retention and the release pipeline in detail.

Request accessSign in