Where your data lives.

Primary storage in Sydney

Wenvar's database and your photo storage, and the nightly copies of original photos, are hosted in the Sydney region of Australia, and the register's web application runs there too. Some of our providers process or store information overseas, as described below.

What leaves Australia

Some information is processed outside Australia. Where a customer switches on AI captions and a person allows them, a copy of each of that person's photos and the project's name go to our AI provider, Anthropic, to suggest captions. Anthropic stores data in the United States and may process it elsewhere; the copy can show anything visible in the photo, including its stamp. For addresses and stamp maps, the iPhone app asks Apple. The Android app and the web camera look addresses up in our own copy of Australia's address file and ask OpenStreetMap only where it has none nearby; their stamp maps, like the register's map, load from OpenStreetMap. On Android phones, Google's location service helps the app find its position. Account email goes through Resend, and website enquiries through Formspree, both in the United States. Anthropic does not use this content to train its models: its terms do not allow it, and training is switched off in our account.

Our provider details list every provider, what it receives, where, and how long it keeps it.

Captured in-app, recorded on capture

Photos taken with the Wenvar camera have their time and their GPS location recorded on capture, written into the record before anything could re-encode, forward or strip the file. The location is the device's own reading within 15 seconds of the photo, never an older or guessed one; if no reading arrives in time, the record has no position rather than a guess. That is a data-quality strength: the record is far less likely to be wrong than a photo pulled from a camera roll or a chat thread, where re-encoding and file-date fallbacks quietly corrupt the story.

Photos imported from elsewhere are accepted too, and the register labels each record's provenance, so in-app captures and imports are told apart.

Access is invited, never open

There is no public sign-up. Every account is created by invitation, belongs to one person, and holds only the projects that person was added to. Removing someone from a project stops their access to it in Wenvar straight away, while their records stay attributed to them. Links they had already opened expire within 15 minutes, and anything already on their device, including images their browser has just shown and copies they saved, cannot be recalled.

A membership is either a register seat, which searches, views, maps, reports and exports, or camera only, which files photos and never opens the register at all.

Two-step sign-in for admins

Every account that can administer anything, the operator, our own admins and every one of your project admins, must sign in with a code from an authenticator app. Anyone else can turn it on if they want it. Phones used for capture only are unaffected.

Access is enforced in the database

Who can see what is decided in the database itself, not only hidden in the interface. A person who is not on a project sees "not found", with no hint that the project exists.

Messages

People with a register seat on a project can message one another about it. Only the people in a conversation can open it in the register, and only while they hold that seat: a project admin who is not in a conversation cannot read it, and someone removed from the project loses the conversation, which does not come back if they are added again. There are two exceptions. When a customer's use of Wenvar ends, it can ask us in writing for a copy of every conversation on its projects, including ones its admins were not in; Wenvar makes it by hand. And we release messages when the law requires it. Wenvar support reaches messages only under its written procedures, by hand and logged. Messages are kept with the project and deleted with it. When you delete a message, its words and any card leave the conversation, and anyone with the conversation open sees that within a few seconds. A note that a message was deleted stays, and copies people already saved are not recalled. We erase the words unless we need to keep them for a legal claim or dispute, or the law requires it. There is no email or notification about messages outside the register.

Encrypted in transit

The website, the register and the capture apps use HTTPS. Connections to the database require SSL, enforced at the database itself, not left to the client to ask for.

Links that expire

Images are served through the application's own authenticated routes rather than long-lived shareable links. Downloading an original mints a 60-second link at the moment of the click. A PDF report or a ZIP export you generate is given a 15-minute link, and the generated file is deleted automatically within two days of being made. A PDF report or photo ZIP downloaded from a message is given a 60-second link, and the file itself is deleted within about a day. A spreadsheet is built in your own browser, and we do not delete copies saved to a device.

Emailed links do exactly two things, invite and password reset. There is no sign-in by emailed link.

Capture facts are settled when a record is filed

A record's time, position and source are settled when it is filed and cannot be changed by anyone using Wenvar, member, admin or project owner. Captions and tags stay editable, because they are working notes; the capture facts are not.

The one exception, and we would rather state it than let you find it: for a photo imported from elsewhere that arrived with no time at all, our own processing service can fill a time in, once, by reading a date printed on the face of the image. That is recorded on the record as "read from image", never as a measurement, and it can never overwrite a time that was already established.

A record of what was done

Hiding, restoring or permanently deleting a photo is written to an append-only log with who did it, when, and any reason they gave. Nobody using Wenvar can edit or remove entries from that log. Our own privileged actions are logged the same way; those entries are kept for 12 months, as our privacy policy explains.

Backups

Our database host backs up the database every day and keeps each backup for 7 days. Original photos are also copied every night to a separate store in Sydney, in our own Amazon Web Services account, separate from Supabase's storage. Its access policy denies every user and role, including our administrator account, permission to delete or overwrite a copy; copies are removed only by an automatic expiry rule, within 30 days after their photo is permanently deleted. Someone with full control of our AWS account could change that policy or the expiry rule.

Because backups and copies are made once a day, a failure could lose changes made since the last one, and the smaller preview copies of photos would need to be rebuilt from the originals. We do not promise a recovery time. We tested recovery in October 2026: we restored a daily database backup and the nightly photo copies into a separate system and checked that every photo came back identical, and in a second test, using sample photos, we rebuilt the smaller preview copies from the originals. Details are available on request.

If your data is exposed

We will tell you. Here is exactly when and how.

Within 72 hours of becoming aware that a security incident has affected your data, we will contact your nominated contact in writing. We will tell you what happened, what information was involved, what we have done about it, and what we recommend you do. If we do not yet know all of that, we will send you what we do know within 72 hours rather than waiting until the picture is complete.

At least every 7 days after that we will send you a written update, until the matter is closed.

We will tell you even when we are not sure the incident is serious. We would rather send you a notice that turns out to be about nothing than have you find out from someone else.

We assess quickly. If we suspect a breach, we start investigating straight away and aim to establish what happened within days. Where the Notifiable Data Breaches scheme applies, the law requires a reasonable and expeditious assessment and all reasonable steps to complete it within 30 calendar days. The Commissioner expects 30 days to be treated as a maximum wherever possible, and so do we. Our 72-hour commitment to you does not delay any notification the law requires.

Where the law requires it, and where a breach is likely to result in serious harm, we will also notify the Office of the Australian Information Commissioner and the affected individuals, as soon as practicable, under the Notifiable Data Breaches scheme in the Privacy Act 1988 (Cth).

Where you are the customer and the affected records are in your register, we will work with you on who tells the people in those records, because they are your workers, your subcontractors and your client.

Report a suspected problem to legal@wenvar.com.au. We answer every report, and we do not take action against anyone who reports a problem in good faith.

How the Notifiable Data Breaches scheme works is explained in the OAIC's guidance. We give customers the detailed obligations in our client security pack.

Questions we welcome

If your project or company has specific requirements, security questionnaires included, get in touch and we will answer them directly, in writing.