Inspection Hero stores your inspections on your devices and syncs them through storage your organization already controls. There’s no Inspection Hero account, no Inspection Hero server, and nothing transmitted to us.

---

Nothing leaves your control

• No vendor cloud. Inspection data, photos, signatures, and audit logs live in a database on each device.
• No account with us. Your team’s accounts are created on the device by your own Supervisor and, with Data Sync, shared with your other devices — never with us.
• No analytics, no advertising, no crash reporting. Nothing in the app reports to us.
• No license phone-home. Plans are activated with a signed key that the device verifies itself.

Every sign-off, digitally signed

Submit, review and approve are each a digital signature made on the signer’s own device, with a key that never leaves it, alongside their drawn signature and a timestamp. On a password account, signing after a Face ID or Touch ID unlock still takes the password, so a shared device never signs for the wrong person. Every device checks every step, and the PDF prints a verdict for each one, with a fingerprint that matches a printed copy to the signed record.

Where other inspection apps can’t follow

Inspection Hero has no server of ours in the path, so it goes where cloud inspection apps aren’t allowed. Nearly every other inspection app is the front end of a database its vendor operates, and that one architectural fact decides which buildings the software may enter.

We hold no certification under any program below, and need none, because we never receive, process, or store your records: no vendor to assess, no agreement to sign, no subprocessor to add to your register. The accredited environment you already run stays the boundary.

Export-controlled and defense work. A photo of a controlled part taken on a shop-floor audit is technical data. It never passes through a third party, so no vendor administrator or foreign person is ever in the path. Work under NIST SP 800-171 and CMMC stays inside the enclave you have already assessed instead of extending it to a cloud service.

Public safety. Jail inspections, evidence-room audits, and 911-center facility checks stay on agency devices and agency storage. The criminal-justice information in them never reaches a provider that would need its own CJIS agreement, personnel screening, and audits.

Air-gapped and closed networks. No internet connection is required for anything — not to start, not to sign, not to export, and not to activate a plan, which uses a signed key the device verifies by itself. Devices on a closed network sync to each other through an S3-compatible store on that same network, over HTTPS with a certificate your own certificate authority issues, and nothing routes out.

Data-residency mandates. GDPR and Schrems II, Saudi PDPL and NDMO rules, the UAE, India’s DPDP Act, provincial residency law in Canada, Australian hosting rules. Your records are wherever your devices and your bucket are, so residency is a setting in your own console rather than a promise from us.

Cloud-authorization programs. FedRAMP, StateRAMP, and TX-RAMP authorize cloud service offerings. Inspection Hero isn’t one, so there is nothing to authorize and no queue to wait in — it’s licensed and deployed like any other application you install.

Critical infrastructure and nuclear sites. Substation, generation, and plant walkdowns produce exactly the system information that NERC CIP and 10 CFR 73.54 programs keep off vendor platforms. It stays in the database on the device and in storage inside your own boundary.

Validated GxP environments. Under 21 CFR Part 11, a vendor that updates its service on its own schedule moves your validated system out from under you. The version you validated stays on the device until you decide to move, and every signature it captures binds a named person, a timestamp, and the record that was signed.

Protected health information. Hospital facility rounds, behavioral-health site checks, and clinic inspections: we never receive PHI, so there is no business-associate relationship to paper.

Trade-secret manufacturing. In a fab, a battery plant, or an API line, the photographs an inspection collects are the process. They stay on your equipment, and customer NDAs that forbid third-party processors stay intact.

Employee data and works councils. In Germany, the Netherlands, and France, inspector names, timestamps, and geotags are employee data, and a tool that could be read as monitoring is a co-determination matter. Nothing is transmitted to us, and nothing about an individual is aggregated anywhere outside your own storage.

Financial third-party risk. DORA and FFIEC programs turn on registers of critical providers, exit plans, and concentration risk. No provider, no entry.

And where there is no signal at all. Underground mines, tunnels, ship holds and offshore platforms, remote pipelines and wind farms, hangars, rail, and disaster response. That one is physics rather than policy, and the answer is the same: the app is complete with the radio off. How offline works has the details.

Each of these in full, with what it changes for your procurement: Restricted environments.

AI Assistant: on the device or your own key

Inspection Hero works with Apple Intelligence on supported iPhone, iPad and Mac. A draft made on the device is processed by Apple’s on-device model, and nothing is sent to us, to Apple, or to any AI service, so no permission is asked. The AI Assistant stays off until a Supervisor turns it on and chooses where it runs: on the device first, your AI key first, or only on the device.

Your own AI key works alongside it, for longer requests, and for photos on devices where Apple Intelligence can’t read them. A Supervisor can require the organization’s key instead of personal ones, and each person allows the AI service once before their first request. Requests go directly from the device to the provider you configure — no Inspection Hero server in the path. Point it at a public provider and the prompt goes to that provider under its terms; point it at a model you host and inspection content never leaves your infrastructure. Each request carries only what that action needs — a checklist description, text read on the device from a scanned checklist (never the image), what you type or say, an item’s answer and notes, a photo you pick for Draft from photo, or an inspection’s results and earlier inspections at the same site for a summary or Insights — and follow-up owners are never included. Every suggestion is reviewed before it’s saved, every AI-drafted field is noted in the audit trail with where it ran, and AI output from either is treated as untrusted input.

Data Sync through your own storage

Devices sync through storage your IT team already operates, so your access policies, encryption at rest, retention, and logging apply: a bucket or container at Amazon S3, an S3-compatible store (Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces, Ceph), Google Cloud Storage, Azure Blob Storage, or Azure Files, with credentials you create in that service. Connections are HTTPS only.

A file share, not a bucket. Connect Azure Files, and Azure File Sync keeps that same share on your Windows file server. If you would rather keep a bucket in the picture, AWS Storage Gateway presents an S3 bucket as a share on your network, and many NAS units ship an S3-compatible service of their own.

Conflicting edits are never silently overwritten: the same field changed on two devices is flagged for a Reviewer to settle, with both values kept.

Access control

• Six roles — Supervisor, Inspector, Viewer, Team Admin, Integrations Admin, and a read-only Auditor who can export backups but not restore them.
• Reviewer and approver flags are independent of role. No one can review or approve their own submission.
• Locked approvals. An approved inspection can’t be edited until an approver reopens it, and the reopen is itself signed and logged.
• Sign-in protection. Minimum 8-character passwords hashed with PBKDF2-SHA256 at 120,000 iterations; a 5-minute lockout after 5 failed attempts; an automatic lock after 15 minutes in the background and once an hour — after a minute away, and on every launch, once Face ID / Touch ID is turned on — re-opened with Face ID / Touch ID or the password.

Single Sign-On

Set it once for the whole organization: a Supervisor saves Single Sign-On and it reaches every device with Data Sync. Test connection checks your identity provider before anyone signs in, and a Supervisor can make Single Sign-On the only way admins sign in.

Google Workspace, Microsoft Entra ID, Okta, OneLogin, Ping Identity, or any OpenID Connect provider, over the authorization-code flow with PKCE — no client secret is stored in the app. Identity tokens are verified on the device against your provider’s published signing keys, including issuer, audience, expiry, and nonce, before anyone is signed in. An allowed sign-in domain list refuses identities outside your organization before an account is ever created. Map your provider’s groups to roles once, and each person’s access follows their group membership at every sign-in.

Audit trail and evidence integrity

• Every create, edit, delete, and status change is written to an audit log; each inspection’s history is visible inline and included in backups.
• Photos are GPS-tagged when permitted, and site geofencing flags any photo taken outside the configured radius.
• A report exported before approval carries a status watermark on every page, so a draft can never be mistaken for the final version.
• Photo location data can be stripped at export with one toggle when a report leaves the organization.

What the record does and doesn’t establish. An inspection captured in the app carries the account, the device, and the moment of capture. Anything that reaches the record another way is tamper-evident from the moment it’s received — you have what arrived, when it arrived, and cryptographic assurance that the bytes haven’t changed since — which is not the same thing as evidence of when or where it was taken. GPS tags and the geofence check are confidence signals, labeled that way on the report rather than presented as verdicts. We would rather your security and legal teams hear that from us than discover it from the other side.

Backups you can actually restore

• Every backup is signed, so a tampered file is detected on import.
• Optional passphrase encryption: AES-256-GCM with a key derived by scrypt, the same on every platform.
• A Supervisor’s encrypted backup is a complete disaster-recovery image — restore it onto a new device (Team plan and above) and roles, sign-ins, and integrations come back intact. Only the passphrase holder can open it.

Secrets stay in the keychain

Integration credentials — storage keys, webhook URLs, bot tokens, API keys — are held in the operating system’s keychain on iOS, never in plain files. Plain backups never include them. Setting up another device? Its settings travel sealed under a short setup code, in a link that opens for 24 hours, and nothing passes through us.

Device permissions

Camera, microphone, and photo library are used to attach evidence to inspection items, and the camera and photo library also turn a paper checklist into a template, read on the device. Location is used to tag photos at the moment they’re taken, to check them against a site geofence, and, only when someone taps Get current weather, to look up the weather at the site — never in the background. Decline any permission and the feature simply stays unavailable.

---