Docs/Administration

Security, Privacy, and Data Handling

Security, privacy and data handling cover how Manifold approaches tenancy, roles, auditability, exports and AI.

For: Admins, security reviewers, and procurement3 min read3 sections

Troubleshooting wizard

Pick the symptom and walk the customer-safe checks before escalating.

Check in order

Next interpretation

If the record appears under a different filter, it was scoped or filtered rather than lost.

Do not send passwords, secret keys, export credentials, or raw private stack traces through support notes.

Role-based permissions control page access and API behaviour.
Tenant scoping keeps each organisation’s data separated, enforced at the database layer.
Client portal access is additionally constrained to the granted client relationship.
Server-side code performs sensitive operations such as export delivery, billing sync, AI calls, and PDF generation.

Check data includes readings, defects, notes, photos, and signatures tied to a property and engineer.
Records are immutable once generated, preserving the evidence trail.
AI features use tenant-scoped rows and should be reviewed before external sharing; the AI & automation tab in Settings shows which AI features are on for your plan and is read-only.
Team management, certificate, delivery and integration changes are written to an audit log. Open Settings and choose the Audit log tab to browse it page by page, or press Export CSV to download the whole log.
Exports and destinations are designed for approved recipients only.
Data in transit is encrypted, integration tokens and export destination credentials are encrypted at rest, API keys are stored hashed, webhooks are signed, and requests are rate-limited.
Gas safety certificates are kept for six years. Deletion is never automatic; an owner chooses when to purge.
Sign-in methods are described under Accounts, Sign-In, and Security. Data location, sub-processors and how to make a data subject request are set out on the privacy page, and requests go to privacy@getmanifold.co.uk.

Troubleshooting

Suspected cross-tenant issue: capture the user, organisation, record URL, and time, then escalate immediately.
Lost export credentials: rotate the destination credential and update the destination in Manifold.
AI output concern: review the source rows and avoid sharing until corrected.

Give each person the least powerful role that still lets them do their job. It keeps client data controlled and keeps the audit trail meaningful.

Use the engineer role for field staff; do not grant office controls they do not need.
Use client portal users for landlords and agents rather than sharing office credentials.
Give everyone their own account so records, approvals, and changes stay attributable.
Deactivate leavers instead of recycling their account for someone new.

Was this page useful?

Notifications and Reminders

Pricing Sanity Checker