Security, privacy and where your data lives

Where the data is

There are no transfers of personal data outside the European Economic Area. If your company is outside the EU, your data is still processed and stored inside it.

Isolation between companies

onCMMS is multi-tenant: many companies share one application. Every business record (asset, request, work order, user, file) carries its company identifier, and the application filters by it on every query, automatically. On top of that, each type of record has an authorization policy that decides who may see or change it.

This is not left to good intentions: the automated test suite seeds two companies and checks that the first cannot list, open, edit or delete anything of the second, including by guessing a direct identifier. Those tests run before every deployment.

Who sees what

• Administrator: everything in their company, including settings and the plan.
• Supervisor: requests, work orders, assets, preventive plans and reports. No settings.
• Technician: only the work orders assigned to them.
• Requester: only their own requests.
• Platform operator (us): can enter a company as its administrator to give support. Every such access is recorded and visible in the company's audit trail.

Deactivating a user removes their access; their past work stays intact. Work orders are never deleted, only cancelled, with a record of who and why.

Audit trail

Every transition of a work order (start, pause, resume, complete, validate, cancel) writes an audit entry with the user and the timestamp, and so do the sensitive actions of administrators and of the platform operator. Time entries are immutable: once recorded they cannot be edited or removed from the application, which is what makes labor cost and MTTR figures trustworthy.

Accounts, passwords and forms

• Passwords: at least 8 characters, stored hashed with the framework's default algorithm. Nobody, including us, can read them.
• The welcome email of an account created from this website carries a generated password so you can log in the same minute. It is sent once and not stored anywhere; the email asks you to change it right away.
• Rate limiting on the login form and on the public QR request form, so a script cannot hammer either.
• CSRF protection on every form inside the application, and a locked-down set of security headers (content security policy, frame protection, no MIME sniffing).

Uploads

Photos and documents are checked by their real content type, not their file extension, and capped at 10 MB each. Files are stored under random names in a private bucket and served through temporary signed URLs: a link to a photo expires, and the bucket itself is not public. Images are resized on upload (2000 px, plus a 400 px thumbnail) with orientation corrected.

Backups

The database is backed up daily, kept on the server and copied off it to encrypted storage, and restoration is rehearsed rather than assumed. Files in object storage are versioned by the provider.

Your rights: export and deletion

Under the GDPR you have the rights to portability and erasure, and we built the tooling before we needed it:

• Export: on request you receive a ZIP with every table of your company as JSON, the main lists as CSV and all files. Day to day, every list in the application also exports to CSV.
• Deletion: a procedure removes the company's data and files completely, after exporting a copy for you.
• Retention: your data stays as long as your account exists. When you leave, it is exported and deleted.

What we do not do

• We do not sell, share or mine your data. The maintenance history of your company is yours.
• No third-party trackers, advertising pixels or analytics cookies, on the website or in the application.
• No AI training on customer data.
• We do not hold formal certifications yet (no ISO 27001, no SOC 2). We would rather say so than imply otherwise; if your procurement requires one, tell us and we will explain where we stand.

Questions from your IT or legal team are welcome at soporte@gmao.es. The privacy policy has the formal version of this page.