Your data is yours, and you can take it with you.
You built the quotes, you won the jobs, you own the records. Here is what you can take out, how, and what Sumitt commits to if the worst ever happened.
Commitment as at 2 September 2026.
What you can export, and how
Everything below lives under Reports and exports inside the app, on every plan, during the trial too. No request, no waiting.
- Quotes, invoices and payments as CSV, for a period or all time. The payments file carries the platform fee, Stripe’s fee and your net on every payment.
- A clients CSV, a Xero-ready invoice CSV in Xero’s import template columns, and a MYOB-ready sales CSV.
- Download everything: a zip of every CSV plus a JSON of your quotes with line items, clients, invoices, payments, jobs, variations, claims and safety-document metadata.
- Printable packs: the signed SWMS or JSA, the site evidence pack with before-and-after pairs, and any risk report.
- A statement of account per client, and the GST summary for any period.
No lock-in
Sumitt is billed month to month (or by the year, if you choose it), and there are no exit fees. Cancel any time from Billing. Cancelling stops the next charge, and you keep access until the end of the period you paid for.
Leaving for good? Export first, then cancel or delete. After a cancellation your data is kept for a reasonable period so you can come back or export it, then deleted or de-identified, apart from the records the law makes Sumitt keep.
If Sumitt ever shut down
Nobody plans for this, so here it is in writing. If Sumitt were ever to close:
- At least 90 days’ notice, by email to every account, before the service closes.
- Every export stays available for the whole notice period: the CSVs, Download everything, the printable packs and the statements. If a bulk copy is easier for you, ask and one will be sent.
- Tax and transaction records the law requires Sumitt to keep are retained for the period it sets (up to seven years, as the Privacy Policy explains), in a restricted form, and then destroyed or de-identified.
- Your data is not sold. Not to a buyer, not to a data broker, not in a wind-down.
This is a commitment Sumitt makes to you, on the record. It sits beside the Terms of Service and the Privacy Policy without changing either of them. It is not a legal guarantee that the business will outlive any particular event; it is what Sumitt will do if it does not.
Where it lives
- Database and file storage: Supabase (Postgres and storage buckets). Application hosting: Vercel. Both run on infrastructure outside Australia, including in the United States, as the Privacy Policy discloses along with Stripe, Anthropic, Resend, PostHog and Sentry.
- Encrypted in transit and at rest.
- One owner per account. Every table carries row-level security keyed to the owner, so a query made with your login can only ever return your rows.
- Accounting connection tokens (Xero) sit in a table with no API access policies at all. Nothing that reaches the database through the public API can read them, not even your own login. Only server code using the service role touches them, after checking your session.
Security practices
These are the practices the code can back, stated as plainly as they are built.
- Row-level security on every table, keyed to the account owner.
- The public quote, invoice, claim and variation pages read through a server-side loader with an explicit allow-list serialiser. Cost, margin and markup are never in the payload, and a test fails the build if a field is added without being allowed.
- Every public link and every API door is rate-limited per address.
- Acceptance is recorded with the client’s typed name, their drawn signature and a timestamp, against the quote as it stood when they signed.
- Stripe holds card details. Sumitt never receives or stores a card number.
- A SWMS or JSA cannot be printed or exported until a person signs it, and a signed version is never edited. A change creates a new version.
- Passwords are handled by the authentication provider and stored only as salted hashes. Sign in with Apple is available on the web and in the app.
- Delete your account yourself from Settings, Account. It takes effect immediately.
What Sumitt does not claim
A short list, kept honest on purpose. When one of these changes it will move up into the section above.
- No SOC 2, ISO 27001 or IRAP certification. Sumitt has not been through an external security audit yet.
- No Australian data residency. Data is hosted in the United States regions of the providers named above.
- No two-factor authentication yet. Sign in is email and password, a one-time code, or Sign in with Apple.
- No uptime guarantee and no dedicated security team. Sumitt is a small team with a large automated test suite and the practices listed above.