Security & Data Lock Guarantee
A transparent overview of how VigilAMC protects your facility rosters, inspection records, and organization credentials.
VigilAMC is pure software. We do NOT provide physical fire AMC services, sell refills, or pitch buildings directly. Your client building list, pricing, and contract expiry dates belong strictly to your agency and are never shared or contacted by us.
What We Do
- Enforce TLS/HTTPS encryption on 100% of network traffic.
- Isolate data by tenant Organization ID in PostgreSQL.
- Validate JWT signatures server-side on every protected API call.
- Employ parameterized queries via Prisma ORM against injection attacks.
- Maintain immutable creation timestamps on all inspection evidence.
- Allow full 1-click export of your complete asset registers anytime.
Transparent Disclaimers
We do not use exaggerated marketing phrases like “bank-grade” or “military-grade”. Security is an ongoing operational commitment. We maintain modern, documented engineering practices and encourage customers to report any potential security inquiries directly to our engineering team.
Core Technical Implementations
Authentication & Session Security
User authentication is powered by Supabase Auth with industry-standard JSON Web Tokens (JWT). All authenticated requests to internal APIs require cryptographically verified bearer tokens with automatic session expiration.
Database Architecture & Multi-Tenant Isolation
All application data is hosted in dedicated PostgreSQL databases on Supabase cloud infrastructure. Records are strictly segregated by Organization ID, ensuring each AMC agency and contractor accesses only their own client rosters and service records.
Transport Encryption & API Security
Strict HTTPS (TLS 1.3) is enforced on all connections via Vercel Edge networks. Queries are executed via Prisma ORM using parameterized queries to protect against SQL injection vulnerabilities.
Role-Based Access Control (RBAC)
Granular permissions divide users into defined tiers: Organization Admins (full management), Field Technicians (restricted to recording asset details, floor notes, GPS position, and photos), and Clients (read-only certificate and asset viewing).
Data Storage & Evidence Retention
Inspection records, service timestamps, defect photographs, and Form-B generation history are stored with tamper-evident creation timestamps to support statutory audit trails.
Backups & Disaster Recovery
The underlying database benefits from automated daily snapshots and point-in-time recovery capabilities managed directly on Supabase cloud infrastructure.
Security Inquiries & Vulnerability Reporting
If you have technical questions regarding data handling or wish to report a security inquiry, please contact our engineering team directly at vigilamc@gmail.com. We acknowledge and address inquiries promptly.