Built so the proof is worth relying on

• Strict separation between accountsYour data is kept apart from every other account at the database itself, not only in the application. One account cannot reach another account's information, by design.
• Encryption in transitEverything you send to and from Astorp travels over an encrypted connection.
• Least-privilege accessPeople see only what their role allows, and guests see only the narrow slice they were invited to. Access is granted deliberately and can be changed at any time.
• Multi-factor authenticationYou can protect your account with a second factor, and any account with administrative reach over the platform is required to use one.
• A tamper-evident historyMeaningful actions are written to a history as they happen, in a way designed to make silent, after-the-fact changes detectable rather than invisible.
• Careful handling of filesUploads are checked before they are trusted, and access to your files is controlled and logged.

You can export a full, machine-readable copy of your data whenever you want it, and you can delete your account and the information tied to it. Reports you have already generated remain available to you. None of these are reserved for a paid plan. They are part of what it means to keep your own evidence.

This page describes the protections built into the product. It is not a certification and it does not promise that any system is beyond every possible risk. If you are evaluating Astorp for a demanding use, read it alongside our privacy policy and data processing notice, and get in touch with specific questions. We will answer them plainly.