Security and privacy in Keursnel

You log in with your email address and a password of at least eight characters. When you sign up, you first confirm your email address. Your colleagues get an invitation from your organisation.

If your email address or password is wrong, you always get the same message. So nobody can tell which email address has an account. The sign-up form does not reveal that either. After too many attempts, you have to wait a while.

Your session is stored in cookies that only the server reads. Scripts in the browser cannot access them.

Logging out only signs out this device. The app also erases the encrypted data on the device when you log out.

• Sign-up with a confirmed email address
• Invitation link: valid for seven days, single use
• Password of at least eight characters
• Session in cookies that only the server reads

Keursnel also works without internet. The first time you open it, the app stores its own files on the device. That is only code, not data.

What you enter and photograph first goes into a queue on the device. For open inspections, the app keeps a working copy.

The queue and the working copy are encrypted with AES-GCM. The key comes from the server, per user. It cannot be exported from the device.

Data leaves the device as soon as it has been sent, when you log out, and after 14 days at the latest. Anything the server refuses stays until you choose to try again or discard it.

Note: the app has not yet been tested on real tablets and phones.

Every table in the database has row-level security (RLS). With it, a user only sees the rows they are entitled to.

The apps read through those rules. Writing only happens through functions on the server. These check for themselves who is asking and what that person is allowed to do.

What each role is allowed to do is stored as data on the server. There are three roles: main admin, manager and team member. A team member has no admin rights.

For each team member, you set what they see: all inspections, or only their own and assigned inspections.

Photos and other files are kept in private storage, with a maximum of 50 MB per file.

• Row-level security on every table
• Writing only through functions that check who is asking
• Three roles and 21 permissions
• Files in private storage

Delivering records the inspection as a report version, with all amounts and ratings. That version never changes again.

Each report version has a SHA-256 checksum. The app verifies that checksum before it shows the version. If it does not match, the app does not show the report.

Each photo also gets a checksum. The original photo never changes; an edit sits on top of it as a recipe. An area you cover up is really gone from the image in the report.

A few parts are read from your settings when the report is shown. They are the cover page, the fixed texts for the header and the signature, and the logo for a dark background.

You share a report with a secret link, per report version. A new version gets a new link. So your client never reads a changed report without noticing.

You can revoke a link at any time. It then stops working, and the file is cleaned up. The shared page has no script, and it tells search engines not to index it.

The app has no trackers and loads no scripts from third parties. Data only goes to a third party in three cases. They are listed below, and they only happen after an action by you or a colleague.

A security rule in the browser (Content-Security-Policy) enforces this. The report itself is one document without scripts, with the fonts and photos embedded. It fetches nothing from outside.

Your data, files and live updates are stored with Supabase. Login runs through Keursnel's own gateway on Vercel.

• The address to PDOK (the BAG of the Kadaster, the Dutch land registry), for year of construction, type of home and floor area
• The building number to 3D BAG (TU Delft), for the volume in m³, for a building with one home
• A font from Google Fonts, if your firm chooses it. After that, it is stored with your firm.

You delete your account yourself in the app, under Instellingen, Account en apparaat (“settings, account and device”). Your account and memberships are then removed. The inspections stay with your organisation.

If you are the main admin, first hand your role over to another member.

You can make a backup of a single inspection. The main admin can also export everything in the organisation. Such a backup is not encrypted. So keep the file in a safe place.

Spotted a security problem? Report the weakness through the contact page.

• Delete your account in the app
• Revoke a share link whenever you want
• Suspend or remove team members
• Deleted inspections stay in the bin for 30 days
• Backup: not encrypted