PadInspectorPadInspector
Security

Your Inspections,
Protected

Photos, voice recordings, and client reports are your professional work product — and they show the inside of your clients' homes. Here's how we keep them safe.

Encrypted in transit

HTTPS/TLS on every connection

Hashed passwords

bcrypt — never stored in plain text

Private by default

Nothing is public until you publish a report

You control sharing

Unpublish a report link at any time

How We Protect Your Data

The same safeguards apply whether you work in the iOS app, on Apple Watch, or in the web portal.

Encryption in Transit

Every connection between the iOS app, the Apple Watch app, the web portal, and our servers is encrypted.

  • All API traffic is served over HTTPS/TLS
  • Watch-to-iPhone transfers use Apple’s encrypted WatchConnectivity channel

Account Protection

Your login is the front door to your work, so we protect it at every step.

  • Passwords are hashed with bcrypt and never stored or logged in plain text
  • Strong-password rules and a blocklist of commonly guessed passwords
  • Temporary lockout after repeated failed sign-in attempts
  • Changing or resetting your password signs out your other devices
  • Password reset links are single-use, expire after one hour, and are stored only as a hash
  • You get an email whenever your password is changed

Access Control & Team Isolation

Each company’s data is isolated, and every request is checked on the server — not just hidden in the interface.

  • Role-based permissions: Owner, Admin, Manager, Inspector, and Viewer
  • Admins can only manage team members with a lower role than their own
  • View-only shares and the Viewer role are enforced as read-only by the API
  • Removing a team member immediately ends their access

Photos, Audio & Files

Inspection photos and voice recordings are sensitive — they show the inside of your clients’ homes.

  • Voice recordings are only available to signed-in team members with access to that inspection
  • Inspection photos stay private until you publish a report that includes them
  • Photos are verified and re-encoded before they are stored, and every upload has a size limit
  • Your company logo and signature image are publicly viewable so they can appear on your reports

Shared Reports

Send clients a web report without giving them an account — while staying in control of the link.

  • Share links use long, randomly generated, unguessable addresses
  • Unpublishing a report permanently revokes its link — a new one is created if you share again
  • Shared links show the finished report only — never your account, other inspections, or raw voice transcripts

Responsible AI Processing

PadInspector uses AI to transcribe your voice notes and draft findings. Your content is used only to do that work for you.

  • Voice recordings and inspection text are sent to our AI provider over encrypted connections
  • Under our AI provider’s API terms, your content is not used to train their models
  • We never sell your data or use your inspection content for advertising
  • Nothing is published until you publish it, and you can edit or remove any AI-drafted finding

Secure on Your Device

PadInspector works offline in basements and crawl spaces, so some data lives on your iPhone or iPad until it syncs.

  • Sign-in tokens are stored in the iOS Keychain — your password is never saved on the device
  • Offline inspection data stays inside the app’s sandbox, protected by iOS data protection
  • Queued changes sync over HTTPS as soon as you are back online
  • Lost a device? Change your password to cut off its access to your account

Limited Internal Access

Our team only accesses customer accounts when needed to provide support.

  • Support access is restricted to a small number of PadInspector administrators
  • Every support sign-in is recorded in an internal audit log
  • Support sessions expire automatically and cannot gain elevated privileges
  • Support staff cannot change your password or delete your account

Retention & Deletion

Your data is yours. You decide how long it stays.

  • Deleted inspections stay in Trash for 30 days, so you can restore them if needed
  • Delete your account at any time from the iOS app or web portal
  • Download any report as a PDF whenever you like

Payments

Billing is handled by Stripe, a PCI DSS Level 1 certified payment processor.

  • Card details go directly to Stripe — they never touch our servers
  • We keep only limited billing metadata such as your plan and subscription status

Hardened Platform

Defensive defaults are built into PadInspector, not bolted on afterward.

  • Hardened HTTP security headers, including clickjacking and content-sniffing protection
  • Unexpected errors return a generic message, never a stack trace
  • The server refuses to start with weak or default secrets

Security Is a Shared Responsibility

A few habits go a long way toward keeping your account and your clients safe:

  • Use a strong, unique password for PadInspector.
  • Keep a passcode or Face ID enabled on the iPhone, iPad, and Apple Watch you inspect with.
  • Give each team member the lowest role they need, and remove people when they leave.
  • Unpublish shared report links your clients no longer need.

Reporting a Vulnerability

If you believe you've found a security issue in PadInspector, please email security@padinspector.com with a description of the issue and the steps to reproduce it. We'll acknowledge your report, keep you updated as we investigate, and let you know when it's fixed.

We ask that you:

  • Only test against your own account and data — never access, change, or delete other users’ information
  • Avoid actions that degrade the service for others, such as denial-of-service or spam
  • Give us reasonable time to fix the issue before disclosing it publicly

We appreciate researchers who report issues in good faith and follow these guidelines.

Questions About Security?

Contact us at security@padinspector.com. For details on what data we collect and how it's used, see our Privacy Policy and Terms of Service.