Some sites won’t let the record leave the building. Inspection Hero has no cloud of ours for it to leave to.

---

The whole argument, in one paragraph

Nearly every inspection app is the front end of a database its vendor operates. The app on the phone is a window; the record lives on their servers, under their administrators, in their region, subject to their update schedule. That single architectural fact — not the feature list, not the price — decides which buildings the software is allowed into, and there are a lot of buildings it isn’t. Inspection Hero inverts it. Records are written to a database on your device, and when devices share work, they exchange changes through a bucket you own. There is no server of ours in the path, so the question that stops every other procurement never comes up.

What we claim, and what we don’t

We hold no certification under any program named on this page, and we don’t need one, because we never receive, process, or store your records. There is no vendor to assess, no agreement to sign, no subprocessor to add to your register, and no cloud service to authorize. The accredited environment you already run stays the boundary, and your existing controls are the controls.

That’s the honest version, and it’s a stronger answer than a badge. A vendor with a certification is telling you their handling of your data has been assessed. We’re telling you we don’t handle it.

---

Policy walls

Each of these blocks the purchase of a cloud service. None of them blocks this.

Export-controlled and defense work

ITAR and EAR technical data doesn’t stop at drawings. A photo of a controlled part, taken on a shop-floor audit, is technical data — and a cloud vendor in the path is a party to the export, with its own administrators, its own support staff, and its own offshore operations to account for. Nothing here passes through a third party, so there is no foreign-person exposure to argue about and no vendor personnel to screen.

Work under NIST SP 800-171 and CMMC stays inside the enclave you’ve already assessed. A SaaS tool touching CUI extends your assessment boundary and your system security plan to cover the vendor. Licensed software running on your own accredited endpoints doesn’t.

Public safety

Jail and lockup inspections, evidence-room audits, 911-center and dispatch facility checks, courthouse and fleet rounds. Criminal-justice information handled by a provider pulls that provider into the CJIS Security Policy — its own agreement, personnel screening, background checks, and audits, for a facilities tool. Records stay on agency devices and agency storage, so no provider is in scope and nothing new lands on your CJIS systems agency’s desk.

Cloud-authorization programs

FedRAMP, StateRAMP, and TX-RAMP authorize cloud service offerings. Inspection Hero isn’t one. There is nothing to authorize, no sponsor to find, and no queue to wait in — it is licensed and installed like any other application on equipment you already run.

Data-residency mandates

GDPR and the transfer analysis that follows Schrems II, Saudi Arabia’s PDPL and NDMO rules, the UAE, India’s DPDP Act, provincial residency law in Canada, Australian hosting rules, and every customer contract that quietly says the same thing. Your records are wherever your devices and your bucket are. Residency becomes a region you choose in your own console — or a server in your own building — rather than a commitment you have to extract from a vendor and then police. With nothing transmitted to us, there is no cross-border transfer to assess and no transfer mechanism to negotiate.

Critical infrastructure and nuclear

Substation, generation, plant, and dam walkdowns produce exactly the system information that NERC CIP programs keep off vendor platforms, and nuclear sites carry the same problem under 10 CFR 73.54 and their safeguards rules. Inspection records stay in the database on the device and in storage inside your own electronic security perimeter.

Validated GxP environments

Under 21 CFR Part 11, a vendor that updates its service on its own schedule moves your validated system out from under you, and you find out afterwards. The version you validated stays on the device until you decide to move. Every signature the app captures binds a named person, a timestamp, and the record that was signed, and approved records lock until an approver reopens them — with the reopen itself in the audit trail.

Protected health information

Hospital facility rounds, behavioral-health site checks, clinic and long-term-care inspections. We never receive PHI, so there is no business-associate relationship to paper, no BAA to negotiate, and no vendor breach that becomes your notification obligation.

Trade secrets

In a fab, a battery plant, an API line, or a defense tooling shop, the photographs an inspection collects are the process. They stay on your equipment. Customer NDAs and flow-down clauses that forbid third-party processors stay intact, and you don’t have to explain a new subprocessor to your own largest account.

Employee data and works councils

In Germany, the Netherlands, and France, inspector names, timestamps, and geotags are employee data, and a tool that can be read as performance monitoring is a co-determination matter — a works-council negotiation before anyone installs anything. Nothing is transmitted to us, and nothing about an individual is aggregated anywhere outside your own storage, which is a far shorter conversation to have.

Third-party risk programs

DORA, FFIEC, and the bank, insurer, and utility programs built on them run on registers of critical providers, exit plans, concentration risk, and the right to audit. No provider, no register entry. The exit plan is that you already hold the data.

Blanket procurement rules

Law firms and their clients. Suppliers whose primes forbid subprocessors. Tribal nations asserting sovereignty over their own records. Insurers and adjusters who have to say where a file has been. And any security questionnaire that ends at “does data leave our control?” — for which the answer is a single word.

---

Physics walls

Not policy. There is simply no signal.

Underground mines and tunnels. Ship holds, offshore platforms, and dry dock. Remote pipelines, wind farms, and substations at the end of a dirt road. Hangars, rail cuttings, cold stores, basements, and elevator shafts. Disaster response, where the network is the thing that broke.

The app is complete with the radio off — capture, review, sign-off, export, and plan activation, which uses a signed key the device verifies by itself. Nothing degrades to a read-only mode and nothing waits for a round trip. When a device comes back into range, changes sync, and conflicting edits are flagged for a Reviewer with both values kept rather than silently overwritten. How offline works walks through it.

---

What makes it true

• No internet connection is required for anything, including activating a plan. No account with us, no analytics, no crash reporting, no license phone-home.
• Sync through storage you own — Amazon S3, an S3-compatible store, Google Cloud Storage, Azure Blob Storage, Azure Files, or a custom sync endpoint you build and run. On a closed network, point it at an S3-compatible store on that same network, over HTTPS with a certificate your own certificate authority issues, and nothing routes out. Every sync connection is HTTPS; the app won’t save one that isn’t.
• Sign-in against your own identity provider, including one on your own network, with identity tokens verified on the device against your provider’s published signing keys.
• Settings move to the next device by QR code, sealed under a setup code, and nothing passes through us.
• An AI Assistant that drafts on the device, or on a model you host, so inspection content never leaves your infrastructure. Inspection Hero works with Apple Intelligence on supported iPhone, iPad and Mac, where drafts stay on the device and work offline, and a Supervisor can keep AI on the device only, so nothing is sent and no AI key is used. Or point your own key at a model you host. It stays off until a Supervisor turns it on, and every AI-drafted field is reviewed before it’s saved and noted in the audit trail.
• Signed backups, optionally encrypted with AES-256-GCM, that restore a whole workspace onto a replacement device.
• Integration credentials in the operating system’s keychain, never in plain files, and never in a plain backup.

Mechanism, algorithms, and key handling: Security & Privacy.

---

What this doesn’t mean

The two things we’d rather you hear from us.

We are not certified under any of the programs above. If your process requires a certified vendor even where no vendor holds the data, we’re the wrong answer, and we’ll say so early.

A record establishes what was captured, not that the work was done. An inspection captured in the app carries the account, the device, and the moment of capture, and the whole chain is signed, timestamped, and tamper-evident from that moment on. GPS tags and the geofence check are confidence signals, labeled that way on the report. Evidence that reaches the record some other way is tamper-evident from the moment it’s received, which is not the same as evidence of when or where it was taken. Any vendor who tells you otherwise has handed the other side something to work with.

---

Bringing it to your security team

Because we never receive your data, most of a questionnaire collapses into the controls you already operate on your devices, your storage, and your identity provider. We’re glad to walk through the architecture with your security or procurement team, answer a questionnaire in writing, and support a pilot inside your boundary before anything is bought.

A perpetual license is a fixed package you can order by invoice. For more than 125 users, offline deployment notes or volume terms, request a quote or write to us directly.

Security questions: support@inspectionheroapp.com