Your building's emergency records, held in Australia and protected by design.
Emredi runs in Amazon Web Services in Sydney, encrypts your database and documents, backs them up every day, and shows them only to the people your organisation chooses. This page says what we do, in plain words, and nothing we do not.
What we do
Six things a safety manager, an IT team or a procurement form asks about, answered from how Emredi is actually run.
Where your data lives
In Amazon Web Services, Sydney region, Australia. Production runs in its own AWS account, separate from the environments we test in.
Your records, your documents and their backups are stored there and nowhere else. Push notifications pass through Apple and Google on their way to a phone, and emails and text messages reach each person through their own provider.
Encryption
Your database and its backups are encrypted at rest, and every connection to the database uses TLS. Uploaded documents are stored encrypted, with public access blocked.
Every connection to the app, the portal and the website is HTTPS; the portal and website also send HSTS, so browsers refuse an insecure connection. Email from Emredi is signed with SPF, DKIM and DMARC, so a forged Emredi email is easier for mail providers to reject.
Who can see what
Your data belongs to your organisation. Blackburn Solutions processes it to deliver Emredi, and for nothing else.
Access is by role: occupants, wardens, site administrators and account administrators each see what their role needs. A safety partner sees a site only when you grant it, and you can revoke it. Details of who needs help to evacuate go only to the wardens responsible for that person's area, your administrators, and a partner you have granted access.
Backups and resilience
The database is backed up automatically every day and backups are kept for seven days. Server volumes are snapshotted daily.
The database runs with a standby copy in a second Sydney availability zone, so a failure in one does not take it down.
Access to our systems
The servers that run the app have no public addresses, and no SSH port is open to the internet on any production server. We administer them through AWS Systems Manager, under the AWS account's own sign-in.
Application credentials are held in AWS Secrets Manager.
Monitoring and incidents
The app's API and the portal are checked from outside the network around the clock, and an outage alerts the operator by text and email.
Found a security problem? Write to help@emredi.app and we will reply from a person. Privacy questions go to the address in our privacy policy.
What we never do
Some things the market sells, and some things that would be easy, that Emredi does not do. Each is a choice, not an omission.
- Sell or share your data for marketingWe send transactional email only: sign-in codes, assignments, alerts. No newsletters, no lists.
- Screen visitors against third-party watchlists or run background checksWe consult no outside list and run no background checks on anyone who signs in.
- Collect biometricsNo facial recognition, no fingerprints, no scanned identity documents.
- Track your location in the backgroundThe app does not collect background location.
- Run conversations over SMSText messages are one-way alerts. Replies are not read, apart from STOP and HELP, which work as our SMS terms describe.
- Show your staff list on a public pageA visitor signing in types the name of the person they are seeing. No visitor page lists your staff; the reception tablet suggests at most three matching names once three letters are typed.
Your data, plainly
What Emredi holds about each kind of person, why, and for how long.
| Who | What we hold | Why | How long |
|---|---|---|---|
| Occupants and wardens | Name, email, mobile, work location, warden roles, training and assignment records, details of any help they need to evacuate, the notification token for their phone, and the messages and answers they send during an emergency event | To alert them, to build the evacuation roll, and to keep the records an emergency plan needs | While your organisation uses Emredi. On account deletion: deactivated at once, a 7-day grace period, then de-identified within 30 days |
| Visitors and contractors | Name, email, mobile, company, purpose of the visit, who they are visiting, sign-in and sign-out times, vehicle registration where the site asks, acceptance of the site's conditions of entry, and whether they need help to evacuate | To put them on the evacuation roll while they are in the building and to reach them if the alarm sounds | A period your site sets, 24 months by default. Records from a real emergency event are kept as evidence |
| Your documents | Plans, diagrams, certificates and records you upload | Your compliance evidence, kept against the right site | While your organisation uses Emredi, encrypted at rest |
Common questions
Is Emredi certified to ISO 27001 or SOC 2?
No. Emredi holds no security certification today, and this page does not claim one. What it does claim is what is on it: Australian hosting, encryption, daily backups, role-based access and no open administrative ports, each of which you can ask us to show you. If that changes, this page will say so.
Where exactly is my data?
In Amazon Web Services' Sydney region, in a production account that holds nothing else. Backups stay in the same region. Notifications pass through Apple's and Google's services on their way to a phone, and text messages go out through AWS from an Australian number.
Can my safety partner see my data?
Only the sites you grant them, and only while you keep the grant. Your organisation owns the account; a partner works inside it at your invitation, and you can change partners without moving your data.
Can I get my data out?
Yes. The portal exports your warden register and course completions as CSV files and your compliance report as a PDF, and your documents are yours to download.
How do I report a security problem?
Email help@emredi.app with what you found. A person reads it, and we will tell you what we did about it.
Who operates Emredi?
Blackburn Solutions, in Australia. The privacy policy says what we collect, why, and how to ask us about it.
Questions
Need this in your procurement form?
Send us the questionnaire and we will answer it from this page and the systems behind it, in plain words, with nothing claimed that is not true.
Talk to usPrefer email? help@emredi.app