Trust Center

Built so a reviewer can trust the record.

AcreSeal's job is to produce records a reviewer can check for themselves. The sections below describe what is in place today and what is not.

Security Architecture

  • Encryption in transit: TLS 1.3 on all browser-to-server connections. HTTP traffic is upgraded automatically; no plaintext fallback.
  • Encryption at rest: Database storage encrypted via the hosting provider's AES-256 key management. Photo evidence is stored in a separate object store with the same encryption posture and per-record access control.
  • Forensic hashing: Each report stores a SHA-256 digest of its GPS point, weather, the photo's capture time (or the time the report arrived) and photo digest, with the raw parts, so anyone can recompute it. Timeline entries are linked by hash; the public check compares those links and does not re-hash entry contents.
  • Hosting region: The database is hosted by Supabase on AWS US East. The vendors listed on our privacy page receive only the fields described there.

Third-Party Audit Commitment

AcreSeal will commission an independent third-party security audit of its cryptographic implementation at its first paying engagement, and publish a summary of the findings.

Regulatory Engagement

AcreSeal follows the PUCT's HB 144 rulemaking (Projects 59431, 59432 and 59996) and FEMA Public Assistance guidance, and reads adopted orders rather than proposals. No regulator has endorsed AcreSeal, and none should be inferred.

Data Handling and Retention

  • Landowner PII: Email and phone are encrypted at rest with AES-256-GCM, using a unique IV per value; the intake form stores no name. Decrypted only within authenticated dashboard sessions for staff with the appropriate role.
  • Retention: Automatic removal is not running yet. It will be running before any report is one year old. It will replace your name, email, phone number and street address with [REDACTED]. The location and description of the pole issue are kept as part of the record.
  • Export on exit: At customer offboarding, all records exportable in standard formats (CSV, JSON, PDF) including the full forensic hash chain. No lock-in on the data the customer owns.
  • Deletion requests: Honored within 30 days for non-regulated records; subject to applicable retention obligations for forensic records.

Incident Response Posture

  • Error monitoring: The application code includes Sentry error reporting, set to strip email addresses and phone numbers before anything is sent.
  • Disclosure: Security issues affecting customer records are disclosed to affected customers within 72 hours of confirming an incident.
  • Vulnerability reports: Email security@acreseal.com. We acknowledge reports within 48 hours and target patch within 7 days for critical issues.

NDA Available on Request

For utility evaluators, procurement reviews, or due-diligence conversations that require deeper detail than this page provides, AcreSeal will sign a mutual NDA on request and share architecture details and security control documentation under that NDA.

Request NDA

Want to verify a specific record?

You can check a landowner complaint record's stored digest and its timeline links in your browser. No login. No subscription.

Go to /verify