How your data is held
Everything on this page is a control that exists in the running system today, not a plan. Where something is missing, it is named — including the certifications we do not hold. A list with nothing missing from it is a list nobody checked.
What we hold
Four kinds of thing, and the fourth is the one worth asking about.
Your work
Jobs, boards, cards, comments, attachments, quotes, invoices, time records and the calendar. This is the data you put in deliberately, and it is yours — a complete CSV export of any board is on every plan.
Who your people are
A name, an email address and a role per member. No date of birth, no national insurance or tax number, no bank details for staff. Payroll export produces figures for your payroll system; it does not become one.
Billing facts
Your company name, billing address, VAT number and what you were charged. No card numbers. The card form is the payment provider's own, so a card number is never in our request logs, our database or a backup — it cannot leak from here because it was never here.
What was done, and by whom
An append-only record of the actions that change money, contracts or access. It exists so a dispute is settled by evidence, and it is designed so that we cannot quietly edit it either — see below.
Who else touches it
The complete list of third parties this software transmits anything to. Not a sample, and not "including but not limited to" — the outbound calls in the code are these and no others.
Scroll the table sideways to see every column.
| Who | What for | What they receive |
|---|---|---|
| Dedicated Infrastructure UK |
The machine and the database | Everything above, at rest. They are the one sub-processor with access to the whole picture, which is why the region is named rather than described as “the cloud”. |
| Stripe | Card payments and subscriptions | Your company name, billing address, email and the amount. They hold the card; we hold a token that can charge it and cannot read it. |
| Postfix Local MTA | Invoices, legal notices, sign-in and password mail | The recipient address and the message. Nothing is sent to a marketing list from here: the notice machinery refuses promotional content by design, because a legal notice that arrives beside an advertisement is a legal notice a court can be persuaded was ignored. |
| The European Commission (VIES) | Confirming an EU VAT number you type in | That VAT number and its country code. Nothing else — not your name, not your address, not who asked. |
| HM Revenue & Customs | Confirming a UK VAT number you type in | The same: the number, nothing around it. |
| Have I Been Pwned | Refusing a password that is already in a breach corpus | Five characters. We hash the password locally, send the first five hex characters of that hash, receive several hundred candidate endings and do the comparison here. The password does not leave, and the five characters match hundreds of millions of passwords, so they identify nothing. |
Every one of those calls goes through one outbound client that refuses any address outside the public internet — so a configuration mistake or a poisoned DNS answer cannot turn one of them into a way to read the inside of our own network.
Controls that are running today
One tenant cannot read another
Every query is written through a layer that adds your organisation to the condition and refuses to run if it cannot. That is a habit in most systems, so here the build refuses to ship a query written around it — the isolation is enforced by something that cannot forget.
Passwords, if the database were stolen
Argon2id at 64 MiB and four passes — memory-hard, so a graphics card gives an attacker far less advantage than it does against SHA-based hashing. A secret held outside the database is mixed in, so a stolen dump on its own is not enough to start guessing.
Sessions expire two ways
Fourteen days at the outside, twelve hours of inactivity, whichever comes first. Session identifiers are stored hashed, so a stolen database does not yield working sessions. You can see every active session and end all of them at once.
Two-factor, and it locks properly
Time-based codes, with each code usable exactly once — replaying a code captured seconds ago fails. The seed is encrypted with a key that is not in the database.
An audit log we cannot rewrite
Each entry commits to the one before it, and the database itself refuses two entries claiming the same predecessor. To change one entry you would have to rewrite every entry after it, and a job walks the chain nightly and would say so. This is the control most audit logs do not have: theirs are rows in a table an administrator can update.
Somebody is told within five minutes
A job reads the error and audit tables every five minutes and delivers what it finds. It carries counts, actions and references — never a message or a query, because those contain customer data and an alert channel is usually a chat room with a wide audience.
Nothing runs in your browser that we did not send
The page tells the browser exactly which scripts are allowed, by per-response token and by content fingerprint. An injected script has no token and the wrong fingerprint, so it does not execute even if it reaches the page.
No third-party code in the product
Zero runtime dependencies — no package manager, no vendor directory, no build step that pulls code from a registry. The single largest source of breach in 2025 was a compromised dependency, and the structural answer to it is not to have any.
Backups that have been restored
Nightly, encrypted, and loaded back into a scratch database on every run so the tables and triggers that came back can be counted. An archive nobody has restored is a file — so the deploy gate reads the date of the last successful restore, not the date of the last file.
The paths worth attacking are rate-limited
Sign-in, sign-up, password reset and the cancellation form are counted per address and per account, in a shared table rather than per web server — so adding a second server does not quietly double every limit.
This page cannot go stale
The build refuses to deploy if the code calls a third party this page does not name, in both languages, or if it names a recipient with no name filled in. The list above is not maintained by whoever remembers — it is maintained by something that fails.
Attachments are not guessable URLs
A file is reached through a signed link valid for fifteen minutes and tied to that one file. A link forwarded by mistake expires; a link altered by hand is refused.
What is not in place
This is the section a buyer should read first, and the reason the rest of the page is worth reading.
Scroll the table sideways to see every column.
| Not in place | What that means for you |
|---|---|
| No SOC 2 report | Nobody outside this company has audited these controls and signed their name to it. What is written above is our own account of our own system. |
| No ISO 27001 certificate | And note that ISO 27001:2013 certificates ceased to be valid on 31 October 2025, so a supplier still showing one is showing you an expired document. |
| No independent penetration test yet | The system has been reviewed adversarially in-house and the findings fixed, which is not the same thing and should not be described as if it were. |
| One region only | You cannot choose where your data lives. It is the same for everyone: UK. |
| No single sign-on | Accounts are email and password, with two-factor available. There is no OIDC or SAML yet, so you cannot enforce your own identity provider's rules here. |
| No per-field encryption of your job content | Credentials and two-factor seeds are encrypted individually; job text and attachments are protected by access control rather than by their own key. |
| No point-in-time recovery | The archive is nightly, so the worst case is losing a day's work rather than an hour's. Transaction-log recovery is planned and is not in place, and a supplier who says "continuous backup" without saying the recovery point is not telling you this number. |
| No 24/7 on-call | Alerting is automatic and within five minutes. A human reading the alert is a business-hours commitment, not a night one. |
| No bug bounty | There is no money in it. There is a reply — see below. |
Getting your data out, and getting it deleted
Out, without asking us
A complete CSV export of any board, on every plan, from inside the app. An export never silently truncates: if it could not include everything it says so in the file itself.
Or all of it, in one archive
Every row we hold for you plus every attached file, as one download, with a manifest stating how many rows each table contains so you can check the archive rather than trust it. No charge, no ticket, no notice period — and if the count does not reconcile we fail the export instead of handing you an archive whose completeness nobody can verify.
Cancelling
At any time, from a link in the footer of every page, with no sign-in required. That is what §312k BGB requires and we do it for every customer regardless of country, because a cancellation route behind a login is one the courts have already condemned.
What we keep, and why
Invoices for ten years, because §14b UStG requires it and that obligation outranks a deletion request. Activity records for 180 days. Everything else goes when you go.
Reporting something
Mail hello@tonic-seo.com with “security” in the subject. You will get a human reply within two working days saying whether we have reproduced it. We will not threaten you, and we will not ask you to sign anything before we will read your report.