Security questionnaire answers

The questions a security or procurement team asks before approving a supplier, answered for Lineplate's Shop Floor. Copy what you need into your own form, or download them as CSV. The long form is the security page, and the processing terms are the data processing terms.

The supplier

Legal entity: Galaxy Technology, a Scottish partnership of Lesley McCoy and Michael McCoy, 31 Priorwood Road, Newton Mearns, Glasgow G77 6ZZ, Scotland. ICO registration ZC212441.
Security and privacy contact: privacy@lineplate.com
Staff with access to production data: Michael McCoy, a partner of Galaxy Technology, through one named administrator account with multi-factor authentication.

Hosting and data residency

Where is our data hosted?: Microsoft Azure, UK South (London): the application, the PostgreSQL database and the file storage for the cloud workspace.
Does anything leave the UK?: Cloudflare sits in front of the site (DNS, TLS, protection from abuse) and sees requests as any host does. Emails are sent through Azure Communication Services. If an owner turns Claude on, the text of each request goes to Anthropic in the US. Nothing else of your workspace leaves the UK.
Where are our CAD files?: On your own computers. The studio reads and draws them in the browser and never uploads them. On Shop Floor, an owner can choose to keep CAD files in the cloud workspace; it is off until they do.

Protection of data

Encryption in transit: TLS on every connection: browser to Cloudflare, Cloudflare to Azure (Full strict), app to database and storage.
Encryption at rest: Azure's encryption at rest (AES-256) for the database, its backups and the file storage.
Separation between customers: Row-level security in PostgreSQL itself: the connection the app uses can only see the rows of the workspaces the signed-in person belongs to, so a bug in our code can't show one customer another's data. The app's database role cannot bypass it; schema changes run separately with their own credential.
Secrets: In Azure Key Vault, read by the app's managed identity. No keys in code or in configuration files.
File storage: One private Azure container, readable only by the app's own identity: no account keys, no public access. Files are named by their SHA-256 and checked when they arrive.

Access and sign-in

How do people sign in?: An emailed sign-in link that works once, within 24 hours. There are no passwords to steal or reuse. Sign-in with Google or Microsoft is not switched on yet.
Sessions: Up to 14 days without a visit. An account that is deleted can't use a session it already had.
Roles: Owner (billing, members, settings, the API), editor (makes and publishes instructions), reviewer (views). Operators at the stations sign with a name and a 4-digit PIN, kept only as a salted scrypt hash, locked for 15 minutes after 5 wrong tries.
Approval of changes: Optional: a published revision waits until a second owner or editor approves it, with a list of what changed. The line keeps the current revision until then.
API: Owner-created keys, shown once and stored only as a hash, read-only, scoped to one workspace, revocable. Webhooks are signed (HMAC-SHA256 over a timestamp and the body) and only sent to public addresses.

Logging and monitoring

Audit log: Every workspace keeps an event log of who published, approved, signed in, invited, saved, trained or changed what, and when. Owners download it as CSV.
Server logs: Kept 30 days in Azure Log Analytics.
Monitoring: Alerts by email on server errors, restarts, failed scheduled jobs and billing errors.

Continuity

Backups: Point-in-time restore of the database across 14 days, in the same region. No geo-redundant backup.
Availability: One region, at least one instance always running. No standby database: recovery is a restore to a new server. We don't offer an uptime SLA.
If the network drops at a station: Tablets keep showing the last revision they loaded, say they are offline, and queue sign-offs and records until the connection is back.
If you leave: Owners export sign-offs, build records, training and the event log as CSV at any time. Your instructions are yours as PDFs and web pages.

Third parties

Cloudflare: DNS, TLS and protection from abuse for every request to the site, and forwarding of email sent to our addresses. Where: a global network, including the US.
Microsoft Azure: hosting of the website, the account database and the projects a Shop Floor workspace saves. Where: the UK (UK South region).
Microsoft Azure Communication Services: sending email: sign-in links, invitations, quote requests, and the drawings you ask us to email. Where: stored in the UK; delivered by Microsoft's mail servers, which may be outside the UK.
Resend: a standby email sender, used only if we switch back to it from Azure Communication Services. Where: the US.
Anthropic: Claude, for a Shop Floor workspace whose owner has turned it on: drafting step captions, suggesting readable part names, translating captions and summarising the week's problem reports. Where: the US.
Google, or Microsoft: single sign-on, only when you choose “Sign in with Google” or “Sign in with Microsoft” (or your workspace requires it): they confirm who you are; each is its own controller for your account with them. Where: the UK, the EU and the US.
Google Ads: measuring our own ads: for a visit that came from one of our Google ads, we upload what followed (a sign-up, a trial or pilot, a payment, a quote or free-drawing request) against the ad's click id. Where: the US and the EU.
Stripe: payments, invoices (including those for the drawing service), the billing page and tax calculation. Where: the UK, the EU and the US.
The European Commission's VIES service: checking an EU VAT number, when an EU business gives one at checkout. Where: the EU.

Incidents, testing and certification

Breach notification: To account owners without undue delay, and within 48 hours of our becoming aware (the data processing terms, section 7).
Certifications: None: not Cyber Essentials, ISO 27001 or SOC 2.
Penetration testing: No independent penetration test has been carried out. You are welcome to test your own workspace; tell us first.
Reporting a vulnerability: Email hello@lineplate.com.
AI: Claude (Anthropic) only if a workspace owner turns it on. It is sent words (step notes, part names, captions, report texts), never geometry, and never writes torque, checks or safety text. Anthropic's commercial terms say it doesn't train its models on data sent through its API.

Something not covered? Email privacy@lineplate.com and we will answer in writing.