Trust centre
Your waste records, kept safe and kept in the UK and EU
Transfer notes are legal records you must keep for two years (three for hazardous). Here is exactly where they live, who can see them and what we have and have not certified yet.
- UK/EUWhere your data is stored and processed
- 99.5%Monthly uptime target in our SLA
- AES-256Encryption at rest
- TLS 1.2+Encryption in transit
Hosting and data residency
Your transfer notes, customer, fleet and site records are stored in the EU (Ireland) and the application runs in London. Email delivery and payment providers are US companies and may process limited data (email addresses, billing details) in the US under the UK International Data Transfer Addendum.
- Database and file storage
- Supabase (Postgres 17) on AWS eu-west-1, Ireland (EU)
- Application servers
- Vercel, London (lhr1)
- Static content
- Vercel global edge network (no customer records cached)
- Product analytics
- PostHog EU cloud, only with consent
- Email delivery
- Resend (transactional email only)
- Payments
- Stripe (card data never touches our servers)
The full list of providers who process personal data for us is on the sub-processors page. Processing terms are in our Data Processing Agreement.
How we protect your data
- Encryption in transit
- Every connection uses TLS 1.2 or higher with HSTS. Signed transfer note links use unguessable tokens that can be revoked.
- Encryption at rest
- The database and file storage are encrypted with AES-256 by our hosting providers. Third-party credentials you give us (accounting, telematics) are additionally encrypted with AES-256-GCM in the application.
- Tenant isolation
- Every table is protected by Postgres row-level security scoped to your team, so one customer’s records can never be read through another customer’s session.
- Access control
- Owner, admin, office and driver roles; optional two-factor authentication; SAML single sign-on and SCIM provisioning for larger teams; a full audit log of changes.
- Backups
- Automated daily database backups managed by Supabase. Point-in-time recovery is planned. Transfer notes can be exported at any time in PDF and CSV.
- Application security
- Rate limiting on every API, bot protection on public forms, dependency updates and code review on every change. Staff access to production is limited to the founder. A strict Content Security Policy is enforced.
Certifications and testing
We would rather tell you where we are than imply a badge we do not hold.
| Standard | Status | Detail |
|---|---|---|
| UK GDPR / Data Protection Act 2018Article 28 Data Processing Agreement and a published sub-processor list for every customer. | In place | Article 28 Data Processing Agreement and a published sub-processor list for every customer. |
| Cyber EssentialsCertification planned; the technical controls it covers are already in place. | Planned | Certification planned; the technical controls it covers are already in place. |
| Independent penetration testCREST-accredited test planned before general availability; summary available under NDA once complete. | Planned | CREST-accredited test planned before general availability; summary available under NDA once complete. |
| ISO/IEC 27001On the roadmap; not certified today. | Planned | On the roadmap; not certified today. |
| SOC 2 Type IINot certified today. We will say so here when an audit starts. | Planned | Not certified today. We will say so here when an audit starts. |
Reporting a vulnerability
If you think you have found a security issue, email security@qwtn.co.uk with steps to reproduce. We acknowledge within two working days and keep you updated until it is fixed.
- Test only against your own account and data. Do not access, change or delete other customers’ records.
- No denial-of-service, spam or social engineering of staff or customers.
- Give us reasonable time to fix the issue before telling anyone else.
- Act in good faith within these rules and we will not take legal action against you.
Machine-readable contact: security.txt. We do not run a paid bug bounty yet.
Availability
Our Service Level Agreement sets a 99.5% monthly uptime target with service credits on eligible paid plans. Live service health is on the status page.
Accessibility: see our accessibility statement.
Last reviewed 12 October 2026. Security questionnaires: email security@qwtn.co.uk.