Security
Security built in from day one, not added later.
Your workspace holds the information your business runs on. Every layer checks who you are before showing anything, and no single safeguard is doing all the work.
- SOC 2 Type IIIndependent audit of our hosting
- ISO 27001Certified security management
- AES-256Encrypted at rest
- TLSEncrypted in transit
- UK GDPRDesigned in from day one
How it all fits together
Three layers of checks stand between your team and your data: sign-in, permissions on the server, and the database's own rules.
You + your team
Open the workspace in any web browser
Secure sign-in
Your usual company login, with SSO and MFA
Your operating workspace
Private to your team, with access controlled by role
Your database
Encrypted at rest and in transit · Row Level Security · backups · audit log
CRM
Pipeline and contacts
Finance
Invoices and revenue
Other tools
Email, calendar, projects and more
Detailed files, emails and financial records stay in these tools.
Security, layer by layer
Each layer adds its own check.
Sign-in
Single sign-on with the login your team already uses, such as Microsoft or Google, with your MFA rules applied
Switch off someone's company account and they can no longer get in.
Permissions
Role-based access and least privilege
Each person sees only what their role needs.
Database
Row Level Security on every table, plus database grants
Even if someone got round the app, the database itself refuses records they're not allowed to see.
Connections
Server-side API keys, encrypted secrets and read-only access wherever possible
The keys to your other tools never reach anyone's browser.
Activity
Audit logging and an activity history inside the workspace
You can see who changed what, and when.
Build and test
Separate development and production environments
We build and test with dummy data. Real data only goes in once everything's been checked.
What we store, and what we don't
The workspace holds only what's needed to run the business day to day: names, contact details, pipeline stages, owners, project status and next actions.
Detailed files, emails and financial records stay where they already live, and the workspace links to them. Less data held means less data at risk.
UK GDPR
- Clear roles. You stay the data controller. The hosting and storage services behind your workspace act as processors, with Data Processing Agreements in place.
- Mapped, not assumed. We document what data flows where, who processes it and why.
- People's rights. Find, export, correct or delete someone's data when asked, with retention rules applied.
- Access from outside the UK. Where a transfer applies, we put the right safeguards in place, such as the UK IDTA.
- An honest note. No certification or hosting provider makes a system GDPR compliant on its own. It comes down to how it's built, set up and run, and that's the part we take responsibility for.
You stay in control
Your business, your data, your system.
Your team can run it
Every process is documented, and we train your team to look after the workspace themselves.
Your data comes with you
Export your data at any time, in formats you can use elsewhere.
You hold the keys
You're the admin. You control who's in, what they see and when access ends.
A clean exit if you need one
If we part ways, we hand over the system and documentation, remove our access and delete anything we no longer need.