Updated 2026-11-01
Security
Survey data is often commercially sensitive. This page sets out where MapShare keeps your scans, who can open them and which providers process them. MapShare is built on infrastructure certified to ISO 27001 and SOC 2. Mirror Mapper Pty Ltd does not yet hold a certification of its own; we will list one here only once it is issued.
Where your data lives
- Database, uploads and converted scans are stored in Sydney, Australia.
- Point clouds, splats and meshes are converted on servers in Sydney.
- Phone photo captures are processed on GPU servers outside Australia for now. We will move them to Sydney once GPU capacity there is approved.
- Original files can be downloaded at any time; you are not locked in.
Who can open a project
- Projects are private until you share them by email invite or a share link.
- Scan files are served through short-lived signed links, issued only after the request is checked against the project's sharing settings.
- Share links can be set to expire, and rotated to cut off an old link.
- Database rules enforce project ownership on every request, not just in the app.
How the service is protected
- All traffic uses HTTPS (HSTS), with a Content Security Policy on every page.
- Sign-in and connector requests are rate limited.
- Stored data is encrypted at rest (AES-256) by our database provider.
- Database backups are taken daily by our database provider.
- Secrets live in our hosting providers' encrypted settings, never in code.
- Dependencies are updated automatically and checked in CI.
Providers that process data
| Provider | Purpose | Region | Provider certifications |
|---|---|---|---|
| Supabase | Sign-in, database and file storage | Sydney | SOC 2 Type 2, ISO 27001 |
| Vercel | Hosts the website and app | Sydney, static files from its global network | SOC 2 Type 2, ISO 27001 |
| Amazon Web Services | Converts point clouds, splats and meshes | Sydney (ap-southeast-2) | SOC 2, ISO 27001, IRAP-assessed services |
| RunPod | GPU processing of phone photo captures | Outside Australia until Sydney GPU capacity is available | SOC 2 Type 2 |
| Stripe | Payments, if you subscribe | Global | PCI DSS Level 1 |
| Resend | Email, such as invites and sign-in links | United States | SOC 2 Type 2 |
| Cloudflare | Relays meeting voice calls when a direct connection fails | Global network | SOC 2 Type 2, ISO 27001 |
| MapTiler | Basemap tiles (sees your IP address and map area, not your scans) | European Union, cached globally | ISO 27001 (self-stated) |
These certifications belong to each provider and cover their own services, not MapShare itself.
Reporting a problem
Found a security issue? Email security@mapshare.app. We reply within two business days. If a data breach is likely to cause serious harm, we notify affected customers and the OAIC as the Privacy Act requires.
Need a security questionnaire filled in or a data processing agreement? Email info@mirrormapper.com.au. See also our Privacy Policy.