Security
What this build is, stated plainly.
Setl Property is at validation stage. Being precise about what exists today is more useful to an organization evaluating it than a page of security vocabulary.
Do not submit sensitive information
Current state
What the validation build includes.
Everything below is accurate for the build you are looking at. Where something is not included, it is not included.
| Capability | State | Detail |
|---|---|---|
| Public marketing site | Included | Static content served over HTTPS. |
| Demonstration environment | Included — fictional data only | Runs entirely in your browser. No database, no backend, no persistence. |
| Review request form | Included — no live endpoint | Validates in the browser and stores nothing until a submission endpoint is configured. |
| Authentication and accounts | Not included | No user accounts exist in this build. |
| Customer data storage | Not included | No customer data is collected or stored. |
| Billing and payments | Not included | No payment processing is present. |
| File upload and processing | Not included | The register upload field is a placeholder; selected files are never read or transmitted. |
The demonstration environment holds fictional sample data in typed local files. Changes you make while inspecting it — transfers, verifications, inspections, imports — are held in your browser session and discarded when you refresh the page. Nothing you type into the demonstration leaves your browser.
Design principles
How data handling is approached.
- Minimum necessary information
- An equipment register needs identifiers, custody, location, condition, and project association. It does not need capability descriptions, configuration detail, or technical data, and the product does not ask for them.
- Separation of the record from the sensitive detail
- The accountability record answers where an item is and who holds it. What the item does, and how, belongs in systems with controls appropriate to that content.
- Evidence stays attached to the record
- Hand receipts, verification scans, and inspection photographs are held against the event they support, which keeps access decisions attached to the record rather than to a shared drive.
- Explicit handling boundaries
- The product states what should not be entered, on the screens where it would be entered. Guidance that only exists in a policy document is guidance nobody reads.
Before a deployment
What a production deployment would need.
Stated so that an evaluation can be honest about the gap between a validation product and a system holding your accountability record.
- Authenticated access with role separation between asset administration, custodians, and read-only reviewers
- An audit log of access and export activity, not only of record changes
- Documented hosting, encryption in transit and at rest, backup, and retention arrangements
- A defined data-handling classification for what may and may not be entered
- Agreed arrangements for evidence storage and access review
- A written determination of whether any content in scope requires controls beyond commercial practice