We use analytics cookies to see how visitors find and use this site. They stay off unless you accept, and you can change your mind any time from the link in the footer. Read our privacy policy.

Manifold

Security

Last updated 18 June 2026

Manifold is gas engineer software that holds the records your business depends on. This page explains the security measures that keep them safe.

Tenant isolation and row-level security

Every organisation's data is isolated. Access is enforced at the database with row-level security, so one business can never read or change another's properties, appliances, checks or certificates. The rules are applied at the data layer, not just in the interface.

Encryption

Traffic between your device and Manifold is encrypted in transit (HTTPS), and data is stored on reputable, managed infrastructure.

Least-privilege access

  • Roles decide what each person can see and do: engineers, office staff, owners and customers each get only what they need.
  • Customer-facing record links are issued as secure, scoped tokens rather than exposing the wider system.
  • Administrative and automated tasks run with narrow, purpose-specific permissions.

Records you can trust

Once a Landlord Gas Safety Record is generated it is frozen. The database itself blocks changes to an issued certificate, so a record always reflects what the Gas Safe registered engineer captured and confirmed on the day. Only delivery details, like who it was sent to and when, are added later.

An audit trail

Significant actions (changes to records, team members, API keys and integrations) are written to an append-only log with who did what and when, so there is always an account of how a record came to be.

Abuse protection

Requests are rate-limited and validated, and outbound connections (exports and webhooks) are checked so they can't be pointed at private infrastructure. Sensitive settings, like integration tokens and export destinations, are encrypted at rest.

Developer access

The API uses scoped keys that are shown to you once, stored only as a hash, and revocable at any time. Outbound webhooks are signed so you can verify they came from Manifold, and the Power BI / OData connector and exports are read-only.

Your data stays yours

You can take your data with you whenever you like: branded PDFs, CSV exports, the read-only API, or the Power BI connector. We don't sell personal data, and we collect only what a job needs.

Built for the field

Manifold is mobile-first and works offline, capturing on device and syncing when a connection returns, so a patchy signal never means lost work or a workaround that bypasses these protections.

Reporting an issue

If you believe you've found a security problem, please email security@getmanifold.co.uk and we'll look into it promptly.