How PermitDesk protects town records
This page is for buyers and IT reviewers. It states the controls that keep staff, applicants and the public in separate lanes, how records are logged, and how a town keeps its data.
Sign-in, roles and separate lanes for staff, applicants and the public
Each person sees only the records and actions their role allows. The server checks the role on every request, not only on the screen.
Staff lane
Staff sign in with MAJIC and work in role queues. A permit technician, reviewer, inspector, planner, code officer, finance staff member and department head each see a different queue and a different set of actions.
Applicant lane
Residents, contractors and business owners use a portal account with a verified email. An applicant sees only records linked to their account or a secure link they hold. A portal account never gives staff access.
Public lane
Public search and a secure link show only the fields that page needs, such as record number, type, status, dates and the next step. Phone, email, payment details, internal notes and draft applications never appear there.
Check your lane in four steps
Open your account menu
Confirm the name, email and role shown on your account. If the role is wrong, contact a town administrator to change it before you work on a record.
Open a queue you should be able to see
Open Today or My queue. You should see only work assigned to you or your department, sorted with overdue items first.
Try an action your role cannot use
The button should be hidden or disabled. If you open a record by a number you were given, the screen should show a plain message that says what your role can do instead.
Check a public record without signing in
Use public search from the portal page with a record number, address or parcel. Confirm that personal details do not appear. See the guide to search a public record.
Encryption, backups, patch timing and incident notice
PermitDesk is hosted in the United States. The controls below are the commitments stated in the town proposals, so a reviewer can check each one at setup.
- Connections use encryption in transit and data is encrypted at rest.
- Nightly backups are kept 35 days with an off-site copy.
- Recovery target in the proposal is one business day, with a recovery point of 24 hours.
- Patches are applied within 14 days, and critical patches within 72 hours.
- The town is notified within 24 hours of a confirmed incident affecting town data.
- Card numbers are handled only by the town payment processor. PermitDesk stores the processor reference and receipt number only.
Confirm these controls at setup in four steps
Record the sign-in method
Confirm how staff sign in, whether multi-factor sign-in is turned on, and how a suspended account loses access at once.
Record the backup and restore check
Ask for the backup schedule, the off-site copy and the date of the last restore test. Record each answer in the town setup checklist.
Record the patch and notice path
Confirm who receives a security or incident notice, by what channel, and within what time. Add that contact to town settings.
Test a payment receipt
Pay a test invoice through the town processor. Confirm the record shows a receipt number and no card number. See the guide to pay a fee.
Audit logging for views, changes, approvals and payments
Every view of personal data, change, approval, payment and configuration change is logged with user and time. The log is append only, so a correction adds a new entry instead of editing history.
What an audit entry shows
Who acted, what they did, which record or setting changed, and when. A status change also writes a history entry on the record and tells the applicant the next step in plain words.
What an audit entry never shows
Secrets, passwords, keys and personal notes are never written to audit detail. If a detail would contain them, staff leave it out and record the action without the value.
Read a record history in four steps
Open the record
Open the record from a queue or search result. Go to the history or timeline section.
Read newest first
Check the latest status change, who made it and the public next-step message the applicant received.
Follow corrections
If an entry was corrected, find the newer entry that points to the earlier one and read the reason recorded there.
Check a payment the same way
Open the fee section and match each payment and refund to its audit entry, receipt number and who recorded it.
Data ownership, retention, export and deletion confirmation
The town owns all of its data. PermitDesk processes it only to run the service. Records are kept on the schedules the town sets, and nothing is deleted automatically without town approval recorded in the log.
Export records and documents
Staff with export permission open the export centre, choose records, fees, payments, contacts, parcels or documents, and download spreadsheets. The file states the filters, date and row limit, and the export is logged with user and time.
Check the export before you rely on it
Open the file, confirm the row count matches the export history entry, and confirm that the data dictionary explains each field.
Set retention by record type
An administrator sets how long each record type is kept and who approved the schedule. Apply the schedule to closed history as read-only records where the town chooses.
At the end of the contract, request the final export
Request a full export of records and documents. Check the counts by type against the cover list, download the package, and keep it with the town records.
Confirm deletion in writing
After the final export is received and checked, ask for written confirmation that town data has been deleted. Store that confirmation with the contract file.
Ask for the security file before you decide
Request a demo and ask for the audit, backup and export checks for your town setup.