Security

Where data is held

The production application and database run on Railway in Amsterdam, inside the EU. Backups are encrypted and stored in the same region. Customer data does not leave the UK or EU and is never stored on personal devices.

This marketing site is separate from the product. It is static, served by Cloudflare, and the only data it collects is what you type into the request-a-look form.

Who can reach it

Access is by named accounts with role-based permissions. There are no shared logins. Multi-factor authentication is enforced on the hosting provider, source control, email and DNS. Credentials and API tokens are held as encrypted environment variables on the hosting platform and never appear in source code. Administrative access is logged, reviewed, and revoked as soon as it is no longer needed.

What we read from connected systems

Every connection to a customer’s existing system is read-only, uses the narrowest scope the system offers, and can be revoked by the customer from their own side at any time. Nothing is written back unless a customer explicitly turns on a two-way sync for a named field.

Before any connection is made we give the customer a written statement of exactly which record types will be read from each system and which will not. For a learning platform that is typically user accounts, enrolments and completions, and not assessment content or grades. For an accounting package it is contacts, sales invoices and payment status, and not bank feeds, payroll or purchase ledgers. For an email tool it is audience members and campaign engagement, and not drafts or billing. For a website it is member accounts and login activity, and not page content, plugin settings or passwords.

Encryption

All traffic uses TLS 1.2 or higher. Data at rest sits on encrypted managed storage. Backups are encrypted. Secrets are encrypted at rest on the hosting platform.

Keeping the software patched

Automated dependency scanning runs on every code change. Critical vulnerabilities are fixed within 7 days and high-severity ones within 30. Operating-system and platform patching is handled by the hosting provider as part of its managed service.

If something goes wrong

We run a documented incident response process. A customer is notified within 48 hours of our becoming aware of any incident that affects its data, which leaves it time to meet its own 72-hour obligation to the Information Commissioner’s Office. The notice says what happened, what data was involved, what we have done and what we recommend the customer do.

Retention and exit

Data is held for the life of the agreement and deleted within 30 days of its end, or sooner on request, with written confirmation. Customers can request a full export in CSV or JSON at any time, including during a trial. Should the company cease operating the service, every customer receives a full export and written confirmation of deletion.

Certifications and assurance

We would rather you knew exactly where we stand than inferred it from logos.

• Cyber Essentials: certification is in progress. The certificate will be published here on issue.
• ICO registration: the data protection fee registration is scheduled to complete before any live customer data connection.
• Hosting provider: Railway publishes its own compliance documentation, which we can supply on request.

Contracts

Every customer signs a data processing agreement that meets Article 28 of the UK GDPR, with a published list of sub-processors. A mutual non-disclosure agreement is available before any trial. Our full policy set is available to any prospective customer on request: information security policy, data classification and encryption policy, incident response policy, vulnerability management procedure, data protection policy and this privacy policy.