Data protection overview

This page summarises how the service protects the data customers put into it, including sensitive details such as PPS numbers, bank details and health information. It supports the Privacy Policy and the Data Processing Agreement.

Where your data is

All customer data is stored on servers operated by DigitalOcean, LLC in Amsterdam, the Netherlands (DigitalOcean region AMS3). This is inside the European Union. Nightly backups are held on the same server and in a second copy at the operator's own premises in Ireland. A few optional features send limited data to the other providers on the sub-processors page.

How it is protected

• HTTPS for all connections; passwords stored only as hashes.
• PPS numbers, bank details and health questionnaires are encrypted in the database, with the key held separately from the data.
• The service is designed so each customer's data is separate from every other customer's, and people only see what their account type allows (Admin, Manager or Worker). Complete the cross-company isolation audit before relying on the first part of this statement.
• Two-factor sign-in (can be required for administrators or everyone), sign-in lock-outs, session time-outs and a “sign out all devices” control.
• An audit log of important actions for each company.
• Nightly backups with integrity checks, 14 days kept on the server and copies held off the server; availability and disk-space monitoring with alerts.
• Our back-office view shows account details only (plan, number of people, billing status), not a customer's business data.

Getting your data out

Administrators can download a complete export of their company's data at any time under Settings → Export your data: every record as readable JSON files plus every uploaded file, in one ZIP. It never includes passwords or secret keys, and other administrators are notified when one is taken. Individual records (timesheets, payslips, test certificates, risk assessments and so on) can also be exported or printed from their own screens. If you need help, we will prepare an export for you within 30 days.

Deleting your data

1. A company administrator requests deletion themselves under Settings → Delete your company (company name and their own password required), or asks us in writing (the in-app Support area or PRIVACY CONTACT EMAIL) and we confirm the request comes from an administrator.
2. Nothing is removed straight away: there is a 7-day cancel window. Every administrator is notified, a warning banner shows, and any administrator can cancel. Use it to take a final export.
3. When the 7 days end the deletion runs automatically: any paid subscription is ended, then every record and uploaded file belonging to the company is removed from the live service.
4. Copies in backups are overwritten as backups expire, within 30 days of the deletion.
5. We confirm deletion in writing by email.

Individual people can be deactivated at any time; their records are kept for the company's own legal record-keeping (for example payroll) until the company deletes them or ends its account.

If something goes wrong (personal data breach)

1. Detect and contain — monitoring and audit records flag unusual activity; we contain it first (for example by revoking sessions or credentials).
2. Assess — what data, whose, how many, and the likely risk to the people affected.
3. Tell customers — we notify affected customers without undue delay and within 48 hours of becoming aware, with what we know and what we are doing.
4. Support the customer's own notifications — customers, as controllers, decide whether to notify the Data Protection Commission (within 72 hours) and the people affected; we provide the information they need. Where we are the controller we notify the Commission ourselves.
5. Review — we record the incident, fix the cause and write up what changed.

Contact

Privacy questions and requests: PRIVACY CONTACT EMAIL. Security concerns: SUPPORT EMAIL.