Evidence
You are liable for the weights you report, so each figure has to show how it was made. Instica keeps that trail for every record and every report.
- Measurement records. Each component weight is stored with its photographs, the person who confirmed it, the time, how the weight was captured (a connected scale, a scale read from the photo, or typed in by hand), and a version history. Figures carry a data-quality tier: measured, supplier, estimated or declared.
- Signed evidence archive. A report can be exported as a signed ZIP containing the records behind it, the methodology document and a manifest.
- Public verification. The public verification page checks an archive against our published signing keys (JWKS) in your browser. The archive is not uploaded to us, and a changed file fails the check.
- Audit log with a hash chain. Every change to customer data is recorded with who made it and when, and each entry is chained to the one before it. You can check the chain in the app and export the log as CSV with the hash columns, so anyone can recompute it. Corrections supersede earlier values; they do not erase them.
- Outside advisers. Give an auditor or consultant access to chosen entities, and optionally chosen periods, until a moment you set: read only, or able to edit figures. Advisers use no seat and cannot sign reports, change billing or manage members.
- Supplier documents. Suppliers answer a request through a private link and can attach their own specification sheets. Documents cited by accepted declarations go into the evidence archive.
A confirmed record attests that a named person confirmed a stated weight at a stated time with the attached evidence. It does not assert that a report is correct under any regulation. Acceptance is decided by the regulator or the producer responsibility organization.
Where Instica Stops
- You submit. Instica prepares the report figures, and a regulator file where its format is verified, and walks you through the portal. You or your signer submit, and Instica keeps the receipt.
- We are not a producer responsibility organization. We do not collect your fees or hold your registration.
- Your counsel decides what applies. We show what each jurisdiction asks for, with its citation. When an answer is unclear, the checker says it needs counsel.
- Acceptance is not ours to decide. We provide evidence-backed records and a written method.
Data Ownership
Your packaging, supplier and sales data belongs to you. You can export it at any time from within the app in a machine-readable format. If an owner closes the account, deletion can be cancelled for 28 days and your data is deleted from our live systems within 30 days. You can choose to keep sealed evidence and the audit log for 1 to 10 years instead. Encrypted backups are never edited, so deleted data leaves them as they expire, and a restore never brings it back. The data retention page states how long each category is kept.
Access and Identity
Roles are owner, admin, contributor, auditor and supplier guest. Members can be limited to specific entities or brands, and signing a report is a separate permission held by a named person. An organization can require a second person to approve a report before it is signed.
- Every plan: sign-in with a password or passkey, multi-factor authentication by authenticator app, passkey or recovery code (which an organization can require), session timeouts and an IP allowlist.
- Scale plan: SAML or OIDC single sign-on through your identity provider (such as Okta, Microsoft Entra ID or Google Workspace) and SCIM provisioning, with break-glass owners who can still sign in with a password when single sign-on is enforced.
- Staff access: Instica staff reach a workspace only through a read-only support tool. Each session needs a written reason, ends after 30 minutes, shows a banner while open, and is recorded in your audit log.
Infrastructure
Instica runs on Google Cloud in the us-central1 region (Iowa, United States). The application, its database, uploaded files and encrypted backups stay in that region, and no other region is offered. Traffic uses HTTPS only; disks and buckets are encrypted at rest, and backups are also encrypted with our own key. Database backups run nightly, with a scheduled restore check. Payments go through Stripe: card numbers go from your browser to Stripe and never reach our servers. The subprocessor list names every outside company that receives customer data.
Availability
Our target is 99.5% availability each calendar month. It is a target, not a contractual promise, and no service credits are attached. Status checks run every minute, and a minute with no result counts as down. The live status page shows each check and its uptime for the last 90 days.
Security Reports and Incidents
To report a security problem, email support@instica.com with the subject line "Security". We confirm receipt within 3 business days, keep you informed, and tell you when it is fixed. Our machine-readable contact is published at /.well-known/security.txt.
If we confirm a security incident that affects your workspace's data, we email your workspace's owners and admins within 72 hours of confirming it, and send a written summary once it is closed.
Documents for a Security Review
The app publishes the documents a vendor review usually asks for:
- Security questionnaire answers: plain answers to the questions procurement teams usually ask.
- Self-attestation of controls: the controls we operate, in our own words. No outside firm has checked them.
- Sub-processors: every outside company that receives customer data, what it receives and why.
- Data processing agreement template: email privacy@instica.com with the subject "DPA" for a signed copy.
- Data residency statement: where your data is stored and processed.
- Service level statement: our uptime target and how the status checks measure it.
- Incident notification commitment: when and how we tell you about an incident.
- Vulnerability disclosure policy: how to report a security problem.
- Accessibility statement: our WCAG 2.2 AA target and what we test.
- Data retention: how long each category of data is kept.
- Privacy policy: what we collect, why, and the rights you hold.
No outside firm has reviewed or tested our controls, and we do not run a paid bug bounty. The self-attestation lists what we do have, and what we do not.
Last updated: October 2026