Everyday work and separate permissions
All active employees can participate in the business's ordinary HSE and quality work. That includes creating, revising, sharing and signing an SJA. Employee roles must not prevent this operational participation.
Company finances and administration are for owners and administrators. Publishing shared procedures, the handbook and company templates requires a separate permission. Sensitive cases require separate case access; being an owner does not automatically reveal every sensitive detail.
Access is checked on the server. This description of the product's design does not confirm that the entire production environment has been verified.
A signature belongs to the content that was reviewed
An SJA signature belongs to a particular version. Changes must not turn an old signature into a signature on new content.
External participants report their own name and company. This is not verified identity or a qualified electronic signature. Participant checks, on-site checks and deciding whether work can begin are separate parts of the workflow.
Unchecked files remain in private quarantine
File scanning has been deferred and must not be described as an active, verified production service. An unchecked user file remains private in quarantine and cannot be completed, previewed or exported as an approved file.
An upload receipt means the upload was received, not that the attachment is approved for use. A report containing selected attachments must wait for the correct file status. Missing file checks must not be bypassed to make a report appear finished.
External backup and recovery have been deferred
An operational external backup has not been verified. Local code and local recovery exercises do not show that the business's data is protected by an active external backup.
European backups targeting no more than 24 hours of potential data loss are a planned level that must be verified in operation. This is not an active backup or recovery-time guarantee.
AI provides text suggestions, not professional approval
The prepared AI setup is limited to short text tasks. There is no basis for promising active analysis of uploaded files or photos, or verified Europe-only processing of all AI data.
Your business must review suggestions before using them. Sensitive case details must not be included in ordinary AI processing. Actual provider configuration, processing and quality must be described from the setup that has been checked.
Choose what leaves the business
Customer reports use explicitly selected job content. Internal comments, restricted information, personal lists and signature images are not included automatically.
Your business previews the content, downloads the finished PDF and sends it. A documented product feature does not establish verified delivery through every real production service.