01
Signing in
Staff sign in with a one-time code sent to their email. Participants and members of the public use secure links that open only what they're meant to see. There are no passwords stored anywhere, so there are none to steal.
Security
How we keep your data safe.
Everything we build handles real people’s information, so security is part of the design from the start. Here’s what that means in practice.
02
Who sees what
Roles and permissions are checked on the server for every single request, not just hidden in the screen. Nobody sees data their role doesn't allow, whatever device they use.
03
A full record
Audit trails run across the system: what changed, who changed it and when. If a question ever comes up, the answer is already written down.
04
Backups and recovery
Weekly backups are kept for 90 days, with 30 days of point-in-time restore on top. Safety checks run before every update goes live.
05
Where your data lives
Your system runs in your organisation's own hosting account, encrypted in transit and at rest. Data can be pinned to Europe where you need it to be, and there are no servers for you to patch.
06
Data protection
Built around UK GDPR: collect only what's needed, clear retention and archive rules, confidential information removed and kept out, and help when someone asks to see the data you hold about them.
07
Safe by default
Automated emails stay switched off until you're ready to launch, and rate limits and file checks protect public forms and uploads.
Talk to us about your data
Start with a conversation, not a contract.
A free, no-obligation conversation about where your team’s work gets stuck and what a system built around it could do, with a rough sense of cost. The thinking is yours to keep.