Security and privacy
Where your data goes, in plain English.
Your subcontractors’ insurance details are business information you’re trusting us with. This page explains exactly how Allsquare handles them. The full details are in our Privacy policy.
Where your data is stored
The Allsquare app and its database run in Sydney, Australia. Certificate files you upload are stored privately and are only shown to signed-in members of your company.
Who can see it
- Every company’s data is kept separate. People in one company can never see another company’s records.
- Inside your company, admins decide who can do what: admins manage everything, members manage subcontractors and certificates, and viewers can only look and export.
- Your subcontractors don’t get an account. Each one can have a private upload link for sending you a certificate: the link only lets them upload, never see anything in your account, and you can replace it at any time to switch the old one off. Anything sent through a link waits for your team to check it.
- Access to the live database is limited to Allsquare’s founder.
How it's protected
- Every connection is encrypted (HTTPS), and browsers are told never to connect without it.
- Passwords are stored as one-way hashes, never as the password itself.
- Sign-in is protected against password guessing: an account locks for 15 minutes after 10 failed attempts.
- New accounts are asked to confirm their email address, and password resets use single-use links that expire after an hour.
- The database provider encrypts the data it stores.
What the AI does, and doesn't do
- When AI reading is on, the certificate you upload is sent to Anthropic’s Claude to read the insurer, policy numbers, dates and limits. Anthropic doesn’t use data sent through its business service to train its models. This processing may happen outside Australia.
- Nothing the AI reads is saved until a person on your team has checked it.
- Allsquare checks what a certificate says. It can’t confirm a policy is still in force after the certificate was issued, and it doesn’t read policy wording or give insurance advice.
Every outside service we use
| Service | What it does for Allsquare | What it sees |
|---|---|---|
| Vercel | Runs the Allsquare app (in its Sydney region) and delivers pages through its global network. | Requests to the app, including what you submit |
| Neon | Hosts the database in Sydney and encrypts the data it stores. | Everything stored in your account |
| Resend | Sends our emails (from Japan and the US): account emails and the reminders you send to subcontractors. | Each email's recipient and content |
| Anthropic (Claude) | Reads certificates when AI reading is switched on. | The certificate being read |
| Stripe | Takes card payments for paid plans. | Your billing details. Allsquare never sees or stores full card numbers. |
| Cloudflare | Manages the useallsquare.com domain name and forwards emails sent to our support address. | Emails you send us |
| Google (Gmail) | Holds our support inbox. | Emails you send us |
Your data is yours
- Export your subcontractor list (CSV) and a compliance report (PDF) whenever you like.
- Plans are month to month. Cancel from your settings at any time.
- To have your company’s account and data deleted, email hello@useallsquare.com.
Found a security problem?
Please email hello@useallsquare.com with the details. We’ll reply, fix it, and thank you.
Last updated 7 November 2026.