Security
Security.
One company must never read another company's work. That is the whole problem, and it is solved in the database rather than in the code that queries it. This page states what is true today, and what is not.
Tenant isolation is a database rule.
Every table carries the company that owns the row, and every table has row level security switched on with a policy that compares that column to the company resolved from your token. Postgres applies it. The application does not get a vote.
This matters because the usual failure is a query that forgets its filter. In Wellplanner a forgotten filter returns nothing rather than somebody else's job: the connection runs as a role that row level security applies to, and a row outside your company is not visible to it at all.
The one deliberate exception is a share link. A token-gated read-only view of a single artifact, a tool string datasheet today, resolves without a login. It is scoped to one row and one company, and it is the only path that reads without a signed-in user.
- Isolation
- Row level security on every table, one policy each
- Identity
- Microsoft Entra External ID. Tokens are validated server-side on every request
- Export
- An administrator can download everything their company holds, without asking us
- Location
- Norway East. Database, API and backups stay in Norway
- In transit
- HTTPS throughout, and the database refuses connections that are not encrypted
- At rest
- Encrypted by the platform, with keys managed by Azure
- Recovery
- Point-in-time restore of the database over a seven day window
Where your data lives.
Norway East, which is Norway rather than the European Union. Norway is in the European Economic Area, so the General Data Protection Regulation applies in full, but the distinction is worth stating plainly because a data residency clause that says "EU" and a service that runs in Norway are not the same sentence.
Each company has its own tenant in one shared database. There is no per company database and no per company deployment, which is what lets one version of Wellplanner exist rather than thirty. Isolation is the row level security above.
Certification and assurance.
A security page that lists only strengths is a sales page. These are the answers a vendor assessment asks for, in the form it asks for them, so you have them before the meeting rather than three weeks into one.
- Certification
- No SOC 2 and no ISO 27001. We will not claim a process we have not been audited against
- Penetration test
- None by an independent party. Commissioning one is the next item on this list
- Availability
- No high availability replica and no geographic redundancy. A regional outage in Norway East is an outage for Wellplanner
- Recovery window
- Seven days of point-in-time restore, not thirty five. Longer retention is a setting we will raise before it matters
- Single sign-on
- Your people sign in through our directory. Federating to your own Entra or Okta is not available yet
- Role enforcement
- A person's role decides what the product shows them, and two things are refused server-side by role: a read-only role cannot write anything, on any endpoint, and administrator actions such as the data export and role assignment need the administrator role. Which screens a role reaches is enforced by the product, not the server
- Audit trail
- Equipment movements record who moved a tool and when. A general audit log across every record is not built
Reporting
Found something? Tell us before you tell anyone else.
If you believe you have found a vulnerability, write to us. We will confirm within one working day, tell you what we found, and tell you when it is fixed. We will not threaten you and we will credit you if you want to be credited.
- Security
- hei@wellplanner.com
- Assessment
- Send your vendor questionnaire to the same address. A person answers it, not a template
- Status
- Current service status