Security built into the platform architecture.
Access control is applied where it counts — on the server, against the signed-in user's company and permissions.
Authentication
Controlled access to SPP accounts.
Authorization
Server-side verification of user permissions.
Tenant Isolation
Company data separated through backend access controls.
Role-Based Permissions
Users only receive permitted functionality.
Secure Integrations
External services use controlled API permissions.
Audit Trail
Important actions can be recorded for traceability.
We describe the controls the platform implements rather than claiming certifications. If your organisation requires a specific compliance position, raise it with us and we will tell you plainly where SPP stands today.
One platform. Separate company environments.
Each company works inside its own environment, with its own projects, users, equipment, activities and documents.
SPP Core
- Projects
- Users
- Equipment
- Activities
- Documents
- Projects
- Users
- Equipment
- Activities
- Documents
- Projects
- Users
- Equipment
- Activities
- Documents
Isolation is enforced server-side
Tenant isolation is enforced by backend and database authorization. Frontend routing, a company name, a URL or a subdomain are not treated as a security boundary. A user belonging to one company does not receive another company's data from the backend.
Control who can see and do what.
Permissions are granted by role and scoped to a company, a project or a module.
Example roles
- Company Admin
- Project Manager
- Preservation Manager
- Supervisor
- Engineer
- Field User
- Viewer
Example permissions
Permission scopes
Company Admin
Can manage users and permissions belonging to their own company. Cannot access other companies, the SPP Super Admin role, or SPP core configuration.
Three lines for your network team.
SPP runs in the browser, on your people's own machines. A security stack that has not met it yet will put it behind isolation and inspection, and the application will be slow through no fault of its own. These are the usual exclusions, asked for once.
Allow *.sppbynur.com
Each company gets its own address under this domain, so the whole domain is what has to be reachable — not one host.
Exclude it from Browser Isolation
Isolation runs the application on the isolation vendor's servers and streams it back. It works, and it is slow, because nothing runs on the user's own machine. Excluding a purchased application is the ordinary treatment — the same as Teams or SAP.
Exclude it from SSL inspection
Inspection re-signs the connection in the middle. It slows every page and can break sign-in with your own Microsoft account, because that flow checks who it is really talking to.
None of this gives SPP access to anything inside your network. It only means your people reach SPP directly, the way they reach the other applications you have bought. Your documents stay in your own storage either way.
Preservation. Connected.
- Equipment
- Schedules
- Job Cards
- QR Identification
- Field Activities
- Documents
- Reporting
- History
One Smart Preservation Platform.