🔒 Security & trust
Built for charity-grade trust.
Your charity's data is sensitive. We treat it that way — UK-hosted, encrypted, GDPR-compliant, audited. Below is how, in plain English.
GDPR · UK serversICO ZA928374SOC 2 Type II in progressCyber Essentials PlusDPA on requestAnnual pen test
🗄
Where your data lives
Stored on Hetzner Cloud servers in Germany (EU), with daily encrypted backups to a second EU region.
- ✓ UK / EU only — no US data transfers
- ✓ Daily backups, 30-day retention
- ✓ Customer-isolated database schemas
🔒
Encryption
AES-256 at rest, TLS 1.3 in transit. Hardware-backed vaults for secrets. Argon2id password hashing.
- ✓ AES-256 at rest
- ✓ TLS 1.3 in transit
- ✓ Argon2id password hashing
📋
Compliance
GDPR compliant, ICO registered, Cyber Essentials Plus. SOC 2 Type II audit expected Q3 2026.
- ✓ GDPR compliant + ICO registered
- ✓ Cyber Essentials Plus
- ✓ Annual external penetration test
🛡
Access & audit
Data actions logged for 12 months on Agency plans. Least-privilege access, MFA required for staff.
- ✓ Per-user audit log
- ✓ MFA required for staff
- ✓ 72-hour incident notification
Subprocessors
The vendors we trust with your data. Updated 12 May 2026.
| VENDOR | PURPOSE | REGION | DATA PROCESSED |
|---|---|---|---|
| Hetzner | Compute & storage | Germany (EU) | All charity data |
| Postmark | Transactional email | EU | Email addresses, alerts |
| Anthropic | AI scoring & drafts | EU API region | Charity profile (no PII) |
| Stripe | Payments | EU + US | Billing only |
| Cloudflare | CDN & DDoS | Global edge | Public marketing pages only |
Trust Report
Documentation and live status available on request.
Status page
Documentation and live status available on request.
Vulnerability disclosure
Documentation and live status available on request.