ASSAYA

Assaya keeps the legal record of fire-safety work. That record has to be there in ten years, defensible and complete. Here is exactly how we protect it.

Last updated: 16 July 2026 · operated by Rockfirepro Ltd (company no. 16969024, England & Wales)

Where your data lives

Assaya runs on infrastructure hosted in the United Kingdom (London). All traffic between your devices and Assaya is encrypted in transit with TLS (HTTPS), with automatically-renewed certificates. Your records stay in the UK for the life of your account.

Isolation — a database of your own

Most software puts every customer's data into one shared database. Assaya doesn't. Each company runs on its own isolated instance with its own separate database. There is no shared table where one customer's query could ever reach another's records. It is a stronger separation than typical multi-tenant SaaS, and it means your golden-thread data is walled off from every other firm on the platform.

Backups & durability

Losing a fire-safety record is not an option, so we protect against it in depth:

• Every instance is backed up automatically every night — the full database and its evidence photos.
• Backups are copied off the live server and retained, so a single server failure can never take the data and its backups together.
• Restores are tested, not assumed — a backup that can't be restored isn't a backup.
• Deleted jobs are kept in full — photos and all — under your own retention policy while your account is active, with no automatic purge; nothing is silently erased. After you cancel, everything is deleted at twelve months, as set out in the terms.

A record that can be attested and shown un-altered

Assaya is built around a duty every fire-safety regime shares: keeping a durable, accurate record of the work, and being able to show years later that it was not changed after the fact. In England, on higher-risk buildings, that duty is the Building Safety Act's golden thread. In Ireland the same record is what an ancillary certificate rests on under BCAR. Elsewhere it is simply what clients, insurers and inspectors ask to see. Every seal carries:

• An append-only, hash-chained revision history — each change stamped with who made it, when (by our server's clock, not a phone's), and the full record state at that moment, then cryptographically sealed (SHA-256) to the entry before it. Altering or removing any past entry breaks the chain for every entry after it, and the whole chain can be re-verified end-to-end from the console at any time.
• A company-wide activity ledger recording sign-ins, amendments, deletions, restores and invitations.
• Photographic evidence for each seal, retained with the record.

Access & accounts

Assaya is invite-only — accounts are created by your administrator, never self-opened by outsiders. Access is role-based (administrator, surveyor, operative, client observer), passwords are stored hashed (bcrypt), and each person can be scoped to specific jobs and specific trades. Client observers get read-only access to only the jobs shared with them.

Your data is yours

You own your records. Assaya acts as the data processor; you are the controller. You can export a full copy of your data at any time, and your data is retained or deleted on your instruction — including a complete handover export if you ever leave, so the golden thread can transfer to a new record-keeper. We do not sell data, and we do not use your records for anything other than providing the service to you.

The people behind it

Assaya is built and operated by Rockfirepro Ltd — a passive fire protection contractor, designed by people who actually carry out fire-stopping surveys and installations, not a generic forms tool retro-fitted to the trade. The firm behind the platform is independently vetted:

• Specialist passive fire protection contractor, built to produce golden-thread evidence to the standard the Building Safety Act regime expects on higher-risk buildings.
• Constructionline Gold prequalified supplier.
• SSIP health & safety accreditation (Once For All Health & Safety), independently assessed by a UKAS-accredited inspection body under ISO/IEC 17020:2012 — valid to July 2027.
• Cyber Essentials certified (NCSC scheme, whole organisation — certificate no. 978eba8f‑b619‑44de‑9d46‑e6958011647e, certified 16 July 2026) — backed by cyber liability insurance.
• ISO 27001 — on our roadmap as we grow.

Certification & ongoing improvement

Who else handles data, and what for

Everyone we rely on, in full. If a supplier is not on this list, they do not touch your data. We keep this list current; if it changes we update it here.

If you are outside the UK: the European Commission decided in December 2025 that the UK offers an adequate level of data protection, renewed until December 2031. EU and Irish customers can therefore use a UK-hosted service without additional transfer safeguards.

We treat security as a continuing programme. If you are a security or procurement reviewer and need more detail — a data-processing agreement, our sub-processor list, or answers to a vendor-risk questionnaire — we will provide it: contact hello@assaya-app.co.uk.

Reporting a concern

If you believe you've found a security issue, please email hello@assaya-app.co.uk with the details. We take every report seriously and will respond.