How Lantern Trace handles your data
What Trace records
Equipment and results: floors, zones, rooms, outlets, zone valves, area alarms, source equipment and booms; the test result for each; pressures and flows where the test calls for them; deficiencies; photos of nameplates, labels, gauges, and the equipment itself; who recorded each item and when. Room names and unit names as the facility labels them.
Trace is not designed to hold patient information, and the forms have no place for it. Technicians are instructed not to photograph patients, charts, or screens.
Where it lives
| Layer | Where | Notes |
|---|---|---|
| Database, authentication, file storage | Supabase (managed PostgreSQL), US West (Oregon) | System of record. Photos are in private storage buckets, served through short-lived signed URLs. |
| The app itself | Cloudflare Pages, served over HTTPS | Static web app; no server of ours sits between the device and the database. |
| On the device | The browser's local database on the technician's iPad or laptop | Results and photos are stored locally until uploaded, so a dropped connection never loses a result. Uploads happen in a fixed order and are idempotent (no duplicates on retry). |
| Twilio SendGrid | Daily recap messages only, to recipients the technician chooses. Reply-to is the technician. | |
| Vision assist (optional) | Anthropic, OpenAI, or Google model APIs | Off by default for every organization. When enabled, a nameplate, label, or gauge photo is sent for a proposed reading. See below. |
Who can see it
- Organizations are isolated at the database layer. Row-level security scopes every table by organization. A testing company sees its own hospitals and technicians, not another company's. This is enforced in the database, not only in the app.
- Hospital technician accounts are scoped to assigned facilities and to outlet-level work. They cannot see other facilities, edit source equipment, or finalize an annual.
- Capabilities are per role and per user: finalize, test zone devices, edit plant, use vision assist, send the daily report. Null means the role default; an administrator can tighten or grant per person.
- The app never carries a privileged key. The browser uses a public key that only works through row-level security; the database's administrative key is not shipped to any device.
- Lantern staff who operate the platform can access the database for support and maintenance. We do not look at a customer's records except to resolve an issue they have raised or to keep the system running.
Accounts and sessions
- Sign-in is email and password through Supabase Auth. Sessions use short-lived tokens that refresh automatically and are cleared on sign-out.
- Organization administrators invite their own people from Settings. Accounts belong to the organization, not to Lantern.
- Devices should be passcode-protected and, where the facility requires it, managed. Trace cannot protect data on an unlocked, unmanaged device; nobody can.
Vision assist
Vision assist is a convenience for reading nameplates, rooms-served labels, and gauges from a photo. It is off for every organization until that organization turns it on, and off for each technician unless granted. When used, it proposes a make, model, serial, or reading; the technician accepts, edits, or rejects. It cannot record a result, write to the registry, or open a deficiency on its own. Photos sent for a reading are the equipment photos the technician already took.
What we do not do
- No advertising or analytics trackers in the app or on this site. No third-party scripts on this site at all.
- We do not sell, rent, or share facility data. Subprocessors listed above receive only what is needed to provide the function described.
- We do not use customer records to train models.
Retention, export, deletion
Records are kept for the life of the customer relationship; an annual test record is the kind of document a facility expects to find years later. Organizations can export their data on request, and the app includes a backup-and-restore of the device's local queue. Deletion requests from an organization administrator are honored, subject to the organization's own retention obligations.
Reporting a problem
If you believe you have found a security issue, email adam.quirk@lanternacademy.com with "security" in the subject. You will get a reply from a person.