Security & data protection
Written for the people who review us before they buy us.
This page describes how the platform handles supplier data and worker reports today, in plain terms, including what we deliberately do not claim. It is maintained by the Libera Europe team and is not a third-party audit.
Libera is designed to support enterprise security and privacy review, with role-based access, row-level security and least-privilege database grants, audit logging, SHA-256 evidence integrity metadata, privacy-minimising worker reporting and human review of every signal. These are internal design choices, not an external certification.
Identity-minimised worker channel
The reporting page asks for no name, phone number, email address or precise location, and requires no account. Libera stores the selected concerns, optional free text, language and time of submission.
Red-flag aggregation
Company users see grouped indicator counts and priorities at supplier or site level. Individual worker narratives are not returned in the management console, reducing retaliation risk.
Workspace controls for sensitive workflows
Database policies and role checks scope organisations, sites, suppliers, cases, case events, evidence metadata, remediation, risk events, audit records and access checks to a workspace. Public visitors cannot read those records; the worker reporting page receives only the workplace names it needs, through the server.
Authentication
Sign-in uses email and password or Google sign-in. Sessions are handled by the managed authentication service; passwords are never stored by us in readable form.
Human review before conclusions
Automated scoring and signal clustering can raise a supplier's priority, but they never produce a finding. A raised status opens a case that a named person reviews, documents and closes with an explicit outcome classification.
Audit trail for due-diligence activity
Each case keeps a timestamped timeline of investigation steps, an evidence register holding metadata only, remediation actions with owners and due dates, and the recorded outcome. The case report prints as a self-contained document for auditors.
Cases hold no worker identity data
A case is linked to the aggregated signal counts that triggered it, never to an individual submission. Confidential worker narratives are not copied into the case layer, evidence records or exports.
Demo data is separated from production data
The synthetic demo portfolio and its demo cases are rendered from a fixed fictional dataset in the application, never written to the database. Demo records cannot reach customer analytics, customer reports or real worker reports, and are labelled as synthetic wherever they appear.
Deletion on request
A workspace owner can delete supplier records from the console. Full-workspace deletion is handled through a written, manual request. There is no configurable automated retention schedule today.
Critical review questions
Straight answers for legal, privacy and IT teams.
Is reporting anonymous?
Libera does not ask for identity, contact details, an account or precise location. We call the channel confidential rather than promise perfect anonymity, because internet infrastructure can create limited technical security logs outside the report itself.
Who can read an individual report?
The customer workspace receives aggregated counts and indicator clusters, not the worker's free-text narrative. Access for authorised safeguarding or investigation roles requires a separate operating agreement and is not part of the current management console.
Where is data hosted?
The application uses managed infrastructure from the providers named below. Region, retention and transfer commitments must be completed in the data processing agreement for each pilot; we do not make an unverified blanket claim that every service and log stays in the EU.
Is Libera ISO 27001 or SOC 2 certified?
No. Libera does not currently hold either certification. We can provide the current security controls and sub-processor information for pilot due diligence without presenting provider certifications as our own.
Can data be deleted?
Supplier records can be removed by a workspace owner. Full workspace and linked-data deletion is handled on written request and documented during the pilot.
What happens in an emergency?
Libera is not an emergency service or a continuously monitored hotline. Every worker flow directs immediate danger to local emergency services and appropriate independent help.
Maturity, stated plainly
What we have today, and what we do not.
Implemented today
- Email/password and Google sign-in through the managed authentication service.
- Organisation-scoped row policies for cases, case events, evidence metadata, remediation, risk events, audit records and worker-access checks.
- Four roles inside a workspace: owner, compliance lead, investigator, read-only reviewer.
- An append-only-in-practice activity record for defined material actions, including report export; customer users cannot update or delete its entries through the application data API.
- A confidential worker channel that collects no identity data and no account.
- Aggregated-only management visibility: counts per indicator, never the worker's text.
- Worker access verification records with site, date, method, access points and outcome.
- Complete separation between synthetic demo content and customer data.
- A privacy statement, draft terms and a DPA template prepared for pilot review.
Not in place yet
- No SOC 2 report and no ISO 27001 certificate. There is no audit in progress today; we will say so here the day one starts.
- No published penetration test report by an independent party.
- No contractually committed uptime or incident-notification window — both are set in the signed agreement rather than announced here.
- No published hosting region guarantee; region and transfer mechanism are confirmed in writing during onboarding.
- No named security officer or published security contact address yet.
An early-stage vendor that claims none of these gaps exist is the one to worry about.
Sub-processors
Supabase
Managed Postgres database, authentication and data API for organisation accounts, supplier records and worker reports.
Cloudflare
Application hosting, content delivery and execution of server functions for the website and console.
Resend
Transactional email delivery for pilot and access requests submitted through the website forms.
The executed DPA must define notice and objection terms for future sub-processor changes; this page does not promise an unagreed notice period.
What we do not claim
- We do not hold a SOC 2, ISO 27001 or comparable audit certificate today.
- We do not describe the channel as zero-knowledge or promise that infrastructure providers create no technical security logs.
- We are not an emergency service and the reporting channel is not monitored around the clock.
- We do not describe Libera as certified, externally audited, GDPR compliant or 100% secure; those are statuses we have not obtained.
- Worker reports are accepted only through the QR/web form; WhatsApp is used for business enquiries only and is not a reporting channel.
- Risk scores are indicators derived from published sources; they are not findings, evidence or accusations.
If a worker is in immediate danger, local emergency services come first — in the Netherlands 112, elsewhere the national emergency number.
Procurement & security review pack
Ask for the DPA draft, our security questionnaire responses, the sub-processor list, the legal entity details and the pilot terms. You get what exists, labelled draft where it is a draft.
Related reading