Skip to content
Book a demo
Security and data protection

Every action has an author, time and permission

A system that stores data about people on your site must withstand the same questions an auditor or regulator asks. Here is how access rights work, how data is separated and which guarantees we record in the contract.

Who sees what

Activity audit · site “Vertikalė”

Try itLIVE
View as

The administrator sees all events and all details. Click an entry — all information opens.

100%WITH 2FA
3BLOCKED TODAY
1 284AUDIT ENTRIES
3 administration levels
4 in the role permissions matrix
2 login factors
0 servers under your management
Access rights

Who sees what on your site

Permissions are configured along two axes: how broad the user’s scope is (system, company or one site) and which areas that role can see. Both axes are configured separately for each site.

Scope levels

System level

GoSpin team — platform maintenance

Tenant level

Your company and all its sites

Site level

One specific site

The same person can have different roles at different sites — for example, site manager at one site and auditor at another.

Sample permissions matrix: roles and areas
Area Security guard Operator Auditor Contractor
Workspace Full permissions Full permissions Limited permissions Area not visible
Patrols and posts Full permissions Full permissions Limited permissions Area not visible
Incidents Full permissions Full permissions Limited permissions Limited permissions
Passes and visitors Limited permissions Full permissions Limited permissions Limited permissions
Reports Area not visible Full permissions Limited permissions Area not visible
Users and permissions Area not visible Area not visible Limited permissions Area not visible
The table can be scrolled horizontally
Full permissionsFull permissions Limited permissionsLimited — view only or own entries only Area not visibleArea not visible

* Sample layout. Each permission is agreed during implementation according to your procedures.

Defense in layers

Four layers — from login to the gate

  1. Identity

    Login requirements are applied centrally — not separately for each user.

    • Mandatory 2FA: Authenticator, SMS or email
    • IP allowlists
    • Country-based access restriction
    • Login history: IP, browser, failed attempts
    • Temporary passwords for employees without email

  2. Isolation

    Multi-tenant architecture: the boundary runs both between companies and between sites.

    • Each client’s data is separated from other clients’ data
    • Data for each site is separated from data for other sites
    • Cloud platform — no servers to install or maintain

  3. Traceability

    The question “who did this and when” has an answer in the system itself.

    • Key actions — with author, IP and exact time
    • Checks, passes and incidents — with photo and location tag
    • REST API request log; sensitive data is masked in it
    • Summary for the selected period — generated by you

  4. Perimeter

    Gates, cameras and sensors are connected without leaving the internal network open.

    • The device is securely assigned to the site (claim)
    • REST API with access keys and role-based permission checks
    • Existing access control does not need to be replaced

    The gateway initiates the connection from inside — no open ports from the internet to your internal network are required.

GDPR

Personal data: who is responsible for what

You — data controller

You make the decisions
  • You determine what data is collected on the site
  • You set retention periods and the access policy
  • You grant and revoke user permissions
  • You decide what the security contractor can see

GoSpin — data processor

We act on your instructions
  • The data processing agreement is signed before implementation
  • We process data only within the scope defined in the agreement
  • We automatically anonymize visitor data when the retention period expires
  • We answer vendor assessment questionnaires

Visitor data journey

  1. Registration

    Visitor or contractor is registered on site

  2. Visit

    Entry and exit are recorded in the pass

  3. Retention period

    You set the duration, not us

  4. Anonymization

    Personal data is removed, while the fact remains for audit

FAQ

Questions an auditor asks

Where is the data stored?
GoSpin operates as a cloud platform — there is no need to install your own servers. The specific data storage location, retention periods and access policy are documented in the data processing agreement before implementation.
Who can see our site data?
Only users you grant permissions to. Data is separated both between clients and between individual sites — an administrator of one site cannot see data from another site.
What can the security contractor see?
Only what you allow. The contractor role is restricted by areas and sites, and records of work performed by the contractor remain in your system, not in the contractor’s documents.
Can we get a detailed security description?
Yes. We provide a detailed description of the security architecture and answers to vendor assessment questionnaires during the assessment.
Does connecting to the gates require opening the internal network?
No. Local equipment is connected through a gateway running on your network — the gateway initiates the connection from inside to the outside, so no open internet-facing ports are required.
Demo

Do you have a vendor security questionnaire?

We provide a detailed description of the security architecture and answers to assessment questionnaires before the contract.

  • We respond within 1–2 business days
  • Demo ~30 min, remote
  • After the call — a quote for your sites