How FreeMaint handles your data, your audits and your safety standards

Yes. FreeMaint is built and operated in accordance with the EU General Data Protection Regulation. Production data is hosted in the European Union (OVHcloud, France), every account ships with a self-service "Delete my account" flow that triggers full erasure including soft-deleted rows. Application errors are reported to PostHog Cloud EU (Frankfurt) without request bodies, headers or cookies; token- and password-like values are scrubbed from messages and URLs before sending. A GDPR-aligned Data Processing Agreement is available for paid tiers on request at contact@freemaint.com.

FreeMaint is HIPAA-ready, not HIPAA-certified. The product ships the technical safeguards required by 45 CFR §164.312: per-user access control, immutable audit logs on every work-order and asset event, e-signature on completion, encryption at rest and in transit, and forced password rotation. A Business Associate Agreement is available on Enterprise ($299/mo flat) for healthcare facilities that need to formalize the controls.

The Lockout/Tagout (LOTO) module enforces compliance with OSHA 29 CFR 1910.147 (US) and EN ISO 14118 (EU). When an asset is locked, the system blocks any work order completion against that asset until the matching unlock event is recorded by an authorized user, logs the lock-type (mechanical, electrical, hydraulic, pneumatic, thermal), padlock number, applier and date. The audit trail is immutable.

Customer data is hosted by OVH in France (European Union), on OVHcloud Public Cloud (GRA region). Backups run daily via pgbackweb to an OVH Object Storage bucket in a separate region. Every tier is hosted the same way: there is no choice of data-residency region. On-premise deployment is paused: no new installations, waitlist only.

FreeMaint is strictly multi-tenant. Every database row (work orders, assets, locations, parts, users, files) carries a companyId column, and every Prisma query, REST endpoint and GraphQL resolver filters on that column inside an authentication-enforcing interceptor. There is no shared resource between companies, and a fine-grained RBAC layer (permission keys, not role names) governs what each user can read or write inside their own tenant.

Passwords are hashed with bcrypt (cost factor 12) and never stored in plaintext or returned by any API. JWT access tokens are short-lived (2 hours) and never persisted server-side. Refresh tokens are httpOnly, Secure, SameSite=Strict cookies. Sign-in with Google and Apple is available; Google/Microsoft 365 SSO, SAML SSO and SCIM provisioning ship on Enterprise. Error reports never include request bodies, headers or cookies, and token- and password-like values are scrubbed from messages and URLs before they reach error tracking.

Yes. The asset management module emits the reports required by the ISO 55000 family of standards (asset register, criticality, lifecycle cost, mean time between failures, planned vs unplanned maintenance ratio). Reports are exportable as PDF and CSV, and the API exposes them as JSON for integration with corporate BI tools. ISO 55000-aligned reporting is included starting on the Business tier ($99/mo flat).

Any account holder can permanently erase their account from /delete-account. The flow removes the user record, anonymizes their authored events (work orders, comments, time logs) per GDPR Art. 17, purges S3 attachments, invalidates all sessions and confirms erasure by email. Company-wide deletion (all users, all data) is available on request from the company admin and processed within 30 days.

Yes. Data is encrypted both in transit and at rest. In transit, all traffic uses TLS 1.3. At rest, file attachments in object storage are encrypted server-side with AES-256, the managed PostgreSQL database and its volumes are encrypted with full-volume LUKS/AES encryption keyed per customer project, and backups are encrypted and stored on separate OVHcloud infrastructure. Passwords are bcrypt-hashed (never reversible) and sensitive application secrets are AES-256-GCM encrypted. All data is hosted in the EU (OVHcloud, France).

FreeMaint acts as your data processor. If we confirm a personal-data breach affecting data we process for you, we notify you without undue delay and within 72 hours, with the nature of the breach, the categories and approximate number of records and people affected, the likely consequences, and the remediation taken. This 72-hour commitment is set out in our Data Processing Agreement (Article 9) and comfortably meets the deadlines that breach-notification laws place on a processor — including GDPR Article 33 and US state laws such as Florida’s FIPA (Fla. Stat. § 501.171), which gives a third-party agent up to 10 days. You then have what you need to notify affected individuals within your own statutory window. Request the DPA at contact@freemaint.com.