Your operational data, isolated and yours.

Every record in TurfOps belongs to one organisation, and isolation is enforced in the database itself through row level security rather than in application code alone. One organisation cannot read another's sites, assets, staff or chemical records.

What a person can see and change is decided by their role and, where relevant, their division. Field staff reach the field capture screens and nothing else. Management, compliance and settings access are each granted separately rather than bundled into one administrator flag.

Field staff sign in with a four digit PIN against a signed, HTTP only session cookie. They hold no email account and no password, which removes the largest credential surface in an operation with hundreds of field workers. Full accounts use ordinary email and password authentication with sessions managed by Supabase.

All traffic is served over HTTPS. Both the application and the database run in the London region (eu-west-2): the application on Vercel, the database on managed Postgres with encryption at rest and automated backups. Operational data does not leave that region in the course of normal running. Third party integration credentials are held server side only and never reach a browser.

TurfOps processes personal information of your staff, principally names, roles, contact details and the record of work they carried out, on your instruction and for the purpose of running your operation. You remain the responsible party under the Protection of Personal Information Act 4 of 2013 and TurfOps acts as an operator on your behalf. Records are exportable in full at any time and are deleted on request when a contract ends. For any POPIA request or question, contact info@turfops.co.za.

Your records are yours. Sites, assets, readings, chemical applications and staff records export in full. TurfOps uses open geospatial data rather than a licensed basemap, so the mapping does not become a reason you cannot leave.