For the permits and their records, the organisation that runs the project decides why and how they are kept. Mighty Spatial runs Mighty Dig for that organisation as its service provider, and uses the records only to run the service.
For your Mighty Dig account itself (your name, email address and passkeys), Mighty Spatial is responsible.
| What | Where it comes from | Why |
|---|---|---|
| Your name, work email address and organisation | You, or the admin who invites you | Your account, and telling you what is waiting for you |
| Your passkeys' public keys | Your device | Signing in and signing permits. Your fingerprint, face or device PIN never leaves your device, and we never see it. |
| When you sign in, through which app, and your device's network address | Your browser | Security: to spot misuse and stop attacks |
| What you sign, when, and where you were if your device gives a location | You, as you work | The permit's signed history, which shows who did each step |
| Photos and files you add, with when and where they were taken | You | The permit's evidence |
| Crew sign-on: name, company, the time, and where you were if you add it | Crew members at the site | So the people running the work know who was briefed and on site |
| If you sign in through your organisation's ArcGIS portal: your portal username, name and groups | Your organisation's portal | Knowing who you are and your roles. We never keep the portal's sign-in token. |
In Australia, in Sydney, backups included. Some of our providers are based in the United States: Fly.io and Tigris, which run the systems in Sydney, and SendGrid, which sends our emails from its own systems there. Their staff may reach the systems from the United States to run them, under contract.
Passkeys instead of passwords. Every step is signed and sealed into a history that shows any change. Data is encrypted in transit and at rest. Backups run every hour to a second place in Australia, including a copy that cannot be altered, and restores are tested every week.
We post changes here with the date, and tell organisations' admins about any significant change before it applies.