Security
You're trusting us with your building's records, your drivers' details and your trustees' papers. Here is what we do to keep them safe, in plain words.
The database, your files, the server code, the encryption keys and the backups are all in Google Cloud's London region (europe-west2).
Sign-in accounts, push notifications, bot protection and the delivery of web pages are global Google services, so they may be handled elsewhere. Our sub-processor list says how that's protected.
Sign in with a link we email you, or with your Google account. There's no password to guess, reuse or leak.
Sensitive actions, such as seeing a driver's licence number or deleting an organisation, ask you to have signed in recently. The app also uses Google's reCAPTCHA to help keep bots out.
Every read and write is checked against the person's membership of the organisation and their role, and anything not allowed is refused. Our automated tests try to reach one organisation's data from another, and a change can't be released if one gets through.
Everything is encrypted in transit and at rest. Driving licence numbers and check results are encrypted again under keys in Google Cloud's key management service, rotated every 90 days.
The database is backed up every day (kept 14 days) and every week (kept 8 weeks), and can be restored to any point in the last 7 days. All of it stays in London.
Significant actions are written to an audit log, kept 6 years. Our application logs never contain names, email addresses, licence numbers or vehicle registrations.
Changes reach the live service only through tested, approved releases.
You do. We only use your organisation's data to provide the service, as our data processing terms set out. Export all of it at any time, as CSV lists and the original files.
This website sets no cookies and runs no analytics or third-party scripts. The app stores only what it needs to work; our device storage page lists it.
If you think you've found a security problem, email hello@trivet.digital and we'll look into it. The privacy notice explains how we use personal information.
Sign in and answer four questions about your organisation. There's no card to enter. When the 90-day trial ends, choose what to pay for, or carry on with the free plan. Nothing is deleted.