Security and Data Handling
How we protect Mavecy, how to report a problem, and how exports and deletion work.
Report a security issue
Email info@mavecy.com with "Security report" in the subject to report a suspected vulnerability, unauthorised access or disclosure of information. Include the affected feature, the approximate time and a safe description. Ask us for a secure channel before sending sensitive records. We acknowledge security reports within 1 business day.
Our safeguards
- Encryption in transit: all traffic to Mavecy uses HTTPS.
- Passwords: stored only as one way hashes (bcrypt), never in readable form.
- Sign in protection: repeated failed sign in attempts are temporarily blocked.
- Workspace separation: every record belongs to one workspace, and the server checks this on every request, so one organisation cannot see another's records.
- Permissions: role based permissions control what each user can see and do.
- Private files: uploaded receipts, documents and voice notes are stored outside the public web folder and served only to signed in users of the same workspace.
- Session security: protection against cross site request forgery, and sessions expire after 2 hours of inactivity.
- Backups: regular automated backups of the database and files through our host, used only for recovery.
- Staff access: only authorised Mavecy administrators can reach production systems, and they open a customer's records only to give support the customer asked for, or to investigate a security or legal issue.
- Providers: bound by written confidentiality and data protection terms (see Subprocessors).
Mavecy holds no security certification, such as ISO 27001, and does not claim one.
Your part
Control who you invite and what roles they have, remove access as soon as someone leaves, use strong unique passwords, and review connected services such as Google Calendar. Two step sign in is not yet available, so a strong password matters.
Exports, retention and deletion
| Exports | Download quotes, invoices and other documents as PDF in the app at any time. Ask info@mavecy.com for a complete export of your workspace records in CSV format, delivered by secure download link within 10 business days, at no charge. The request must come from the account owner's email address. |
|---|---|
| After cancellation | 30 days to sign in, download documents and request an export |
| Live data deletion | Deleted or de-identified within 90 days of the subscription ending, or sooner on the account owner's written request |
| Backups | Expire within 30 days after deletion from live systems |
| Kept by law | Our own subscription, payment and tax records about your account, for 5 years. Security logs for 12 months. |
If we ever restore from a backup, records that were deleted before the restore are deleted again before normal use resumes.
Incidents
We investigate reported incidents and follow our contractual and legal notification duties, including section 22 of POPIA and the 72 hour customer notice in the Data Processing Agreement. Questions about the service agreement go to info@mavecy.com.