Data security & privacy

01Purpose and Scope

This statement explains how SoilLab, operated by GEOTECH4ALL LTD, protects the data that your organisation stores in its SoilLab company workspace: projects, borehole and CPT records, field and laboratory tests, foundation analyses, site photographs, AGS files, reports, team chat and user accounts. It describes the controls in place on 9 November 2026.

02At a Glance

03Data Ownership

• Your organisation retains full ownership of all project data uploaded to or generated within SoilLab.
• SoilLab uses your data only to provide the service to you. We do not sell it, share it with other customers or use it for advertising.
• We do not use your project data to train AI models.

04Workspace Isolation and Access Control

• Database-level separation. Every table that holds company data has row-level security rules. Each read or write is checked against the signed-in user's workspace membership inside the database itself, so a fault in a screen or a modified browser cannot reveal another company's records.
• Named users only. People join your workspace only through an invitation from your workspace admins. The number of seats is fixed in your subscription.
• Roles. Admins and co-admins manage members and roles; members work on projects. Removing a member ends their access immediately.
• Protected billing and status. Payment status, subscription dates and suspension are stored in protected records that users cannot edit, and are enforced by the database.

05Encryption and Hosting

06Sign-in and Accounts

• Users sign in with email and password or with their Google account.
• Passwords are stored only as salted hashes by the authentication service; SoilLab staff cannot read them.
• Password resets are sent to the user's registered email address.
• Sessions are signed tokens checked by the server on every request.

07SoilLab Staff Access

To run the service, a small number of named SoilLab platform administrators have technical access to workspaces. This access is used to:

• create workspaces, manage subscriptions, seats and payments;
• see usage totals (numbers of projects, tests and reports) to monitor the health of the service;
• open project contents only when you ask for support or give permission, or where the law requires it.

08AI Features and Service Providers

AI report writing and document intake send the relevant project data to an AI model through SoilLab's AI gateway, only when a user runs one of those features. The response is returned to your workspace. SoilLab relies on these providers:

09Backups and Continuity

• Records are held on managed cloud database infrastructure.
• Project, laboratory and foundation records are also copied to a separate backup database as they are saved.
• If the internet connection drops while SoilLab is open, edits are kept on the device and upload automatically, with a conflict check, when the connection returns.
• If a subscription lapses, your data is not deleted: it stays viewable, and only new projects and exports pause until renewal.

10Retention, Export and Deletion

• Data is kept for as long as your workspace exists, including after a subscription ends, so work is never lost by accident.
• Export your data at any time: AGS 4.2 files and PDF reports from the app, or a complete workspace export on request.
• On written request from an authorised admin, we delete the workspace and its data from the live service and from the separate backup copy.

11Security Monitoring and Incidents

• Database access rules and software dependencies are checked with automated security scans, and issues found are fixed.
• If we confirm a security incident affecting your data, we will notify your workspace admins without undue delay, explain what happened and what we are doing about it.

12Your Responsibilities

• Invite only people who need access, and remove leavers promptly.
• Use strong, unique passwords and keep sign-in details private.
• Sign out on shared computers — unsynced offline edits are kept in that browser until uploaded.
• Review AI-generated text and calculations before issuing reports.

13Data Protection

SoilLab handles personal data (names, email addresses and roles of your users) only to provide the service, in line with the principles of the Nigeria Data Protection Act 2023 and UK GDPR. SoilLab does not currently hold an independent security certification such as ISO 27001 or SOC 2; this statement describes the controls in place.