Last updated: October 12, 2026
Your maintenance history, permits and signatures are your company’s record. This page explains how Mantenix protects them, what it runs on and who processes the data.
Mantenix does not hold an ISO/IEC 27001 or SOC 2 certification of its own. Our infrastructure runs on providers that do, and what follows describes how the product is built on top of them.
The web platform, the mobile app and their connections to our services travel over HTTPS/TLS.
The database, the files and the sync service for the mobile app are stored encrypted at rest by their providers (Supabase, Cloudflare R2 and PowerSync, according to their security documentation). Passwords are stored as a hash, never in plain text.
Mantenix is multi-company: every record belongs to one organization, and every query is automatically limited to the organization of the person who is signed in. One company never sees another’s data.
The mobile app follows the same rule: a device only downloads its company’s data and, if the person’s access is limited, only that of their sites.
Each person sees and does only what their role allows, and access can be limited to specific sites.
Photos, voice notes and documents are kept in private storage, never at a public address.
A file only opens after Mantenix checks that you are allowed to see it, and then through a signed link that expires within minutes.
To work without signal, the app keeps a copy of the work orders, assets and parts of your sites in its own local database, inside the app’s private storage on the device.
The session token is kept in the phone’s secure storage (Keychain on iOS, Keystore on Android). When you sign out, the app deletes the local copy; if changes are still unsent, it keeps them until they can be sent. Protect the phone with a screen lock.
The AI features send to Anthropic (text, photos and manuals) and OpenAI (voice notes to transcribe) only what each task needs, so that they return a suggestion a person reviews. They process it on Mantenix’s behalf.
Under both providers’ terms for API customers, the data sent through their API is not used to train their models by default.
Mantenix runs on these providers. The certifications listed are theirs, as each one publishes on its own trust or compliance page.
Hosting of the application and file storage (Laravel Cloud Object Storage).
Source: laravel.com
The cloud infrastructure Laravel Cloud runs on.
Source: ISO/IEC 27001, SOC 2
The database (managed PostgreSQL).
Source: supabase.com
The private storage behind the files.
Source: ISO/IEC 27001, SOC 2 Type II
Syncing data with the mobile app for offline work.
Source: docs.powersync.com
Sending the service emails.
Source: resend.com
AI features: classifying, suggesting and reading nameplates and manuals.
Source: privacy.claude.com
Transcribing voice notes to text (Whisper).
Source: trust.openai.com
The certifications belong to each provider and cover their services; they are not a Mantenix certification, nor an endorsement of Mantenix by those companies. Each provider decides the scope of its certifications: check the sources for details.
The data a company records in Mantenix belongs to it. We do not sell personal data or use it for advertising. The privacy policy explains what data we process and why.
Anyone can delete their account from the web platform, and request the deletion of their personal data.
How to delete your account and dataIf you believe you found a security problem in Mantenix, write to support@mantenix.com with the steps to reproduce it. Please do not access, change or delete other people’s data, and give us reasonable time to fix it before making it public.
Write to support@mantenix.com