How your data is held
Everything on this page is a control that exists in the running system today, not a plan. Where something is missing, it is named — including the certifications we do not hold. A list with nothing missing from it is a list nobody checked.
What we hold
Four kinds of thing, and the fourth is the one worth asking about.
Your work
Jobs, boards, cards, comments, attachments, quotes, invoices, time records and the calendar. This is the data you put in deliberately, and it is yours — a complete CSV export of any board is on every plan.
That includes voice notes recorded on a job. A recording of somebody's voice is personal data: it is stored, exported and erased exactly like a photograph, and deleting it from the job deletes it from storage.
Who your people are
A name, an email address and a role per member. No date of birth, no national insurance or tax number, no bank details for staff. Payroll export produces figures for your payroll system; it does not become one.
Billing facts
Your company name, billing address, VAT number and what you were charged. No card numbers. The card form is the payment provider's own, so a card number is never in our request logs, our database or a backup — it cannot leak from here because it was never here.
What was done, and by whom
An append-only record of the actions that change money, contracts or access. It exists so a dispute is settled by evidence, and it is designed so that we cannot quietly edit it either — see below.
Who else touches it
The complete list of third parties this software transmits anything to. Not a sample, and not "including but not limited to" — the outbound calls in the code are these and no others.
Scroll the table sideways to see every column.
| Who | What for | What they receive |
|---|---|---|
| Dedicated Infrastructure UK |
The machine and the database | Everything above, at rest. They are the one sub-processor with access to the whole picture, which is why the region is named rather than described as “the cloud”. |
| Stripe | Card payments and subscriptions | Your company name, billing address, email and the amount. They hold the card; we hold a token that can charge it and cannot read it. |
| — | Uploaded files, archived supplier invoices and certificates | The files themselves, encrypted before they leave this application, and the storage keys. Where no separate object store is configured this is the host above, because that is where the files then are. Documents a statute requires kept unaltered are written once and cannot be deleted through this application at all. |
| Postfix Local MTA | Invoices, legal notices, sign-in and password mail | The recipient address and the message. Nothing is sent to a marketing list from here: the notice machinery refuses promotional content by design, because a legal notice that arrives beside an advertisement is a legal notice a court can be persuaded was ignored. |
| The European Commission (VIES) | Confirming an EU VAT number you type in | That VAT number and its country code. Nothing else — not your name, not your address, not who asked. |
| HM Revenue & Customs | Confirming a UK VAT number you type in | The same: the number, nothing around it. |
| Have I Been Pwned | Refusing a password that is already in a breach corpus | Five characters. We hash the password locally, send the first five hex characters of that hash, receive several hundred candidate endings and do the comparison here. The password does not leave, and the five characters match hundreds of millions of passwords, so they identify nothing. |
Every one of those calls goes through one outbound client that refuses any address outside the public internet — so a configuration mistake or a poisoned DNS answer cannot turn one of them into a way to read the inside of our own network.
Not on this list, because we do not send it anything: your browser's speech service. If you press the microphone to speak a job title, your browser records it and sends it to its own maker's service to be turned into text — Google's in Chrome, Apple's in Safari — and we receive only the text. That is a service your browser provides to you, not a sub-processor of ours: we have no contract with it and it never receives anything from us. The app says so before the microphone is used for the first time, and does not offer it where the browser has no such service.
Controls that are running today
One tenant cannot read another
Every query is written through a layer that adds your organisation to the condition and refuses to run if it cannot. That is a habit in most systems, so here the build refuses to ship a query written around it — the isolation is enforced by something that cannot forget.
Passwords, if the database were stolen
Argon2id at 64 MiB and four passes — memory-hard, so a graphics card gives an attacker far less advantage than it does against SHA-based hashing. A secret held outside the database is mixed in, so a stolen dump on its own is not enough to start guessing.
Sessions expire two ways
Fourteen days at the outside, twelve hours of inactivity, whichever comes first. Session identifiers are stored hashed, so a stolen database does not yield working sessions. You can see every active session and end all of them at once.
Two-factor, and it locks properly
Time-based codes, with each code usable exactly once — replaying a code captured seconds ago fails. The seed is encrypted with a key that is not in the database.
An audit log we cannot rewrite
Each entry commits to the one before it, and the database itself refuses two entries claiming the same predecessor. To change one entry you would have to rewrite every entry after it, and a job walks the chain nightly and would say so. This is the control most audit logs do not have: theirs are rows in a table an administrator can update.
Somebody is told within five minutes
A job reads the error and audit tables every five minutes and delivers what it finds. It carries counts, actions and references — never a message or a query, because those contain customer data and an alert channel is usually a chat room with a wide audience.
Nothing runs in your browser that we did not send
The page tells the browser exactly which scripts are allowed, by per-response token and by content fingerprint. An injected script has no token and the wrong fingerprint, so it does not execute even if it reaches the page.
No third-party code in the product
Zero runtime dependencies — no package manager, no vendor directory, no build step that pulls code from a registry. The single largest source of breach in 2025 was a compromised dependency, and the structural answer to it is not to have any.
Backups that have been restored
Nightly, encrypted, and loaded back into a scratch database on every run so the tables and triggers that came back can be counted. An archive nobody has restored is a file — so the deploy gate reads the date of the last successful restore, not the date of the last file.
The paths worth attacking are rate-limited
Sign-in, sign-up, password reset and the cancellation form are counted per address and per account, in a shared table rather than per web server — so adding a second server does not quietly double every limit.
This page cannot go stale
The build refuses to deploy if the code calls a third party this page does not name, in both languages, or if it names a recipient with no name filled in. The list above is not maintained by whoever remembers — it is maintained by something that fails.
Attachments are not guessable URLs
A file is reached through a signed link valid for fifteen minutes and tied to that one file. A link forwarded by mistake expires; a link altered by hand is refused.
What is not in place
This is the section a buyer should read first, and the reason the rest of the page is worth reading.
Scroll the table sideways to see every column.
| Not in place | What that means for you |
|---|---|
| No SOC 2 report | Nobody outside this company has audited these controls and signed their name to it. What is written above is our own account of our own system. |
| No ISO 27001 certificate | And note that ISO 27001:2013 certificates ceased to be valid on 31 October 2025, so a supplier still showing one is showing you an expired document. |
| No independent penetration test yet | The system has been reviewed adversarially in-house and the findings fixed, which is not the same thing and should not be described as if it were. |
| One region only | You cannot choose where your data lives. It is the same for everyone: UK. |
| No SAML single sign-on | An Enterprise workspace can require sign-in through its own identity provider with OpenID Connect. SAML is not offered, and the OpenID Connect sign-in has not yet been tested against every major provider. |
| No per-field encryption of your job content | Credentials and two-factor seeds are encrypted individually; job text and attachments are protected by access control rather than by their own key. |
| No point-in-time recovery | The archive is nightly, so the worst case is losing a day's work rather than an hour's. Transaction-log recovery is planned and is not in place, and a supplier who says "continuous backup" without saying the recovery point is not telling you this number. |
| No 24/7 on-call | Alerting is automatic and within five minutes. A human reading the alert is a business-hours commitment, not a night one. |
| No bug bounty | There is no money in it. There is a reply — see below. |
Getting your data out, and getting it deleted
Out, without asking us
A complete CSV export of any board, on every plan, from inside the app. An export never silently truncates: if it could not include everything it says so in the file itself.
Or all of it, in one archive
Every row we hold for you plus every attached file, as one download, with a manifest stating how many rows each table contains so you can check the archive rather than trust it. No charge, no ticket, no notice period — and if the count does not reconcile we fail the export instead of handing you an archive whose completeness nobody can verify.
Cancelling
At any time, from a link in the footer of every page, with no sign-in required. That is what §312k BGB requires and we do it for every customer regardless of country, because a cancellation route behind a login is one the courts have already condemned.
What we keep, and why
Invoices for eight years, because §14b UStG binds us as a German supplier and that duty outranks a deletion request. It was ten until the Fourth Bureaucracy Relief Act shortened it with effect from 1 January 2025. That period is ours, not yours: how long you must keep your own records is set by the law where your business is established, which for a British business is not the UStG. Activity records for 180 days. Everything else goes when you go.
Reporting something
Mail hello@job-deck.co.uk with “security” in the subject. You will get a human reply within two working days saying whether we have reproduced it. We will not threaten you, and we will not ask you to sign anything before we will read your report.