Security overview
Security and governance
Written for the reviewer who has to sign off on a field operations platform. Everything on this page is something Flacron Energy does today, and we will walk you through any of it.
Certifications
Flacron Energy does not hold SOC 2 or ISO 27001 certification, and we will not imply otherwise. What is above is what the platform does today, and we will walk a security reviewer through any of it.
Controls
How operational data is protected
Enforced by the server on every request — the interface is a convenience, never the boundary.
Role-based access control
Every route and action sits behind a permission key checked by the API. Hiding a control in the interface is a convenience, never the boundary.
Tenant isolation
Every record is scoped to a company. A cross-tenant lookup answers the same 404 as a record that does not exist — it never reveals that it is someone else's.
Verified identity
Authentication is server-verified on every request, and a verified email address is required before any data route will answer.
Two-step verification
Anyone can add an authenticator-app code to their sign-in, and a company admin can require it for the whole company — then the API refuses every data request from a session that did not enter the code.
Session handling
Tokens are refreshed in the background and route guards re-check on navigation, so a revoked or expired session stops working rather than lingering in an open tab.
Encryption in transit and at rest
Traffic is served over TLS, and records and uploaded files are stored on encrypted managed cloud infrastructure.
Access-controlled files
Photos, videos, and documents live in your company's own storage prefix and are served through short-lived signed URLs, not public links.
Rate limiting
Every request is counted against the address it came from, with tighter ceilings on the routes that send mail. Refusals answer 429 with a Retry-After, so a well-behaved client backs off instead of being cut off.
Audit logs
Creates, updates, status transitions, and refused access attempts are recorded with the actor, the target, and the time.
Access history you can read
The audit viewer is yours, filterable by actor, action, target, and date, and exportable as CSV — you do not have to ask us for it.
Data export
Reports export as PDF, Word, Excel, and CSV; the audit trail exports as CSV. Your records leave in formats you can open without us.
Configurable permissions
Roles are data, not hardcoded. Build your own from the published permission catalog and assign it without waiting on a release.
Access model
Who can do what
Seven built-in roles, their real permission counts, and the separation of duties the API enforces — published so you do not need a call to find out who can approve what.
| Role | Keys | Can do |
|---|---|---|
| Field Inspectorfield_inspector | 14 | Runs inspections, raises safety reports, generates reportsThe mobile persona. Cannot approve a permit or close a work order. |
| Maintenance Technicianmaintenance_technician | 11 | Accepts, progresses, and submits assigned workDeliberately cannot sign off its own work — closure is a separate gate. |
| HSE Managerhse_manager | 17 | Approves permits, closes safety findings, reads the audit logThe only operational role that can authorise hot work and isolation. |
| Operations Manageroperations_manager | 20 | Owns the asset hierarchy, templates, and work-order lifecyclePlans and closes work; does not administer users or roles. |
| Executiveexecutive | 11 | Read-only across every module, plus the audit logCannot change a single record — useful for boards and auditors. |
| Company Admincompany_admin | 27 | Everything in the tenant: users, roles, settings, all modulesOwns its own company and nothing outside it. |
| Super Adminsuper_admin | 28 | Company admin plus platform administrationThe one role holding platform.admin. |
Counts are the real permission-key totals of each built-in template. Roles are editable, and every gate is enforced by the API — not by hiding a button.
Roles are data, so your job titles fit
The seven roles are templates, not a fixed list. Build a role from the permission catalog, name it what your organisation calls the job, and assign it — no release and no ticket to us. Titles customers define today:
- Regional Manager
- Site Manager
- Maintenance Manager
- Contractor
- Auditor
- Read-only Viewer
Separation of duties
Doing the work and accepting it are different permissions — work_orders.write against work_orders.close, and safety.write against safety.close — so the person who carried out a repair cannot be the person who signs it off.
Permission keys
Every module, and the permission behind it
The keys the API checks before each module will answer. Assign them through roles; nothing is reachable without one.
| Module | Permission keys |
|---|---|
| Asset management | assets.read · assets.write |
| Sites and hierarchy | facilities.read · facilities.write · areas.read · areas.write |
| QR identification | assets.read |
| 3D facility view | facilities.read · facilities.write |
| Inspections and checklists | inspections.read · inspections.write · checklist_templates.read · checklist_templates.write |
| AI photo and video analysis | inspections.write |
| AR measurement and annotation | inspections.write |
| Work orders | work_orders.read · work_orders.write · work_orders.close |
| Preventive maintenance plans | work_orders.read · work_orders.write |
| Permit to workOperations and Enterprise | permits.read · permits.write · permits.approve |
| Safety reporting | safety.read · safety.write · safety.close |
| Corrective actions | safety.write · safety.close |
| Controlled documents | documents.read · documents.write |
| Training modulesEnterprise | assets.read |
| AI report generation | reports.read · reports.generate |
| Users, roles, and permissions | users.manage · roles.manage |
| Audit trail | audit.read |
| Company settings and billing | company.settings |
How personal data is handled is set out in the Privacy Policy. To report a vulnerability or start a security review, contact us.
Put us in front of your security team
Book a walkthrough for your security or IT reviewer, or contact sales about Enterprise requirements.