ASSAYA

Assaya keeps the legal record of fire-safety work. That record has to be there in ten years, defensible and complete. Here is exactly how we protect it.

Last updated: 16 July 2026 · operated by Rockfirepro Ltd (company no. 16969024, England & Wales)

Where your data lives

Assaya runs on infrastructure hosted in the United Kingdom (London). All traffic between your devices and Assaya is encrypted in transit with TLS (HTTPS), with automatically-renewed certificates. Your data stays in the UK for the life of your account.

Isolation — a database of your own

Most software puts every customer's data into one shared database. Assaya doesn't. Each company runs on its own isolated instance with its own separate database. There is no shared table where one customer's query could ever reach another's records. It is a stronger separation than typical multi-tenant SaaS, and it means your golden-thread data is walled off from every other firm on the platform.

Backups & durability

Losing a fire-safety record is not an option, so we protect against it in depth:

• Every instance is backed up automatically every night — the full database and its evidence photos.
• Backups are copied off the live server and retained, so a single server failure can never take the data and its backups together.
• Restores are tested, not assumed — a backup that can't be restored isn't a backup.
• Deleted jobs are kept in full — photos and all — indefinitely by default; nothing is silently erased.

The golden thread — attested and immutable

Assaya is built around the Building Safety Act's duty to keep a durable, accurate record of fire-safety work. Every seal carries:

• An append-only, hash-chained revision history — each change stamped with who made it, when (by our server's clock, not a phone's), and the full record state at that moment, then cryptographically sealed (SHA-256) to the entry before it. Altering or removing any past entry breaks the chain for every entry after it, and the whole chain can be re-verified end-to-end from the console at any time.
• A company-wide activity ledger recording sign-ins, amendments, deletions, restores and invitations.
• Photographic evidence for each seal, retained with the record.

Access & accounts

Assaya is invite-only — accounts are created by your administrator, never self-opened by outsiders. Access is role-based (administrator, surveyor, operative, client observer), passwords are stored hashed (bcrypt), and each person can be scoped to specific jobs and specific trades. Client observers get read-only access to only the jobs shared with them.

Your data is yours

You own your records. Assaya acts as the data processor; you are the controller. You can export a full copy of your data at any time, and your data is retained or deleted on your instruction — including a complete handover export if you ever leave, so the golden thread can transfer to a new record-keeper. We do not sell data, and we do not use your records for anything other than providing the service to you.

The people behind it

Assaya is built and operated by Rockfirepro Ltd — a passive fire protection contractor, designed by people who actually carry out fire-stopping surveys and installations, not a generic forms tool retro-fitted to the trade. The firm behind the platform is independently vetted:

• Building Safety Act–certified passive fire protection contractor.
• Constructionline Gold accredited.
• SSIP health & safety accreditation (Once For All Health & Safety), independently assessed by a UKAS-accredited inspection body under ISO/IEC 17020:2012 — valid to July 2027.
• Cyber Essentials — independent assessment complete, certification in progress.
• ISO 27001 — on our roadmap as we grow.

Certification & ongoing improvement

We treat security as a continuing programme. If you are a security or procurement reviewer and need more detail — a data-processing agreement, our sub-processor list, or answers to a vendor-risk questionnaire — we will provide it: contact hello@assaya.co.uk.

Reporting a concern

If you believe you've found a security issue, please email hello@assaya.co.uk with the details. We take every report seriously and will respond.