Security, privacy and compliance, designed in from the start

For IT, legal, risk and procurement reviewers. This page explains how the Hub protects your data and helps you meet your obligations. For full detail, request our security pack.

Request the security pack

ON THIS PAGESecurity Privacy Compliance Availability Security pack

Security

Encryption

In transit using TLS 1.3 and at rest using AES-256 across databases, evidence files and backups.

Managed keys

Keys are managed in dedicated key stores, rotated cleanly and scoped per tenant on enterprise tiers.

Data separation

Organisation workspaces are logically separated from every other customer at database level.

Strict audit logs

Append-only records capture permissions changes, spend approvals, money movements and data access.

Upload integrity

Documents are scanned, virus-checked and cryptographically fingerprinted against reuse or tampering.

Backups & resilience

Automated encrypted point-in-time recovery across multi-zone cloud regions in the UK and EU.

Testing

Annual independent CREST-accredited penetration testing with summaries shared under NDA.

Privacy

Built for UK GDPR, EU GDPR and equivalent international privacy legislation across every country pack.

We collect only the identity, operational and compliance records needed to verify work and prevent fraud.

Raw identity selfies and photo ID captures used for verification are automatically deleted within 24 hours.

Citizen repair voucher programmes verify eligibility without exposing resident personal details in scheme exports.

Clear data-processing agreements (DPAs) and sub-processor schedules are provided to all enterprise buyers.

Full subject access, rectification, portability and deletion workflows are built directly into account settings.

Compliance the Hub helps you with

LAW	WHAT THE HUB DOES
Extended Producer Responsibility (EPR)	Captures item-level take-back collections, recovery routes and packaging tonnage evidence.
UK & EU Product & Battery Passports	Issues scannable QR/NFC/RFID records tracking materials, care, repair history and next life.
Waste Duty of Care	Blocks any waste job or material lot from going to carriers or receivers missing active permits.
Reviews & consumer protection (DMCC Act)	Permits reviews only from real transactions, prohibits bought reviews and logs all removals.
Sustainability reporting (Scope 3 & CSRD)	Delivers site-level repair and reuse records alongside transparent, method-labelled impact ranges.
Right to repair	Connects manufacturers and consumers to authorised repair workshops and genuine spare parts.
Green claims rules	Blocks unsupported environmental claims on listings unless backed by verifiable evidence.
Accessibility	Designed toward WCAG 2.1 AA across web booking, admin tools and offline venue door check-in.

Our availability target

We are designing the core platform, partner APIs and evidence pipelines for 99.95% monthly availability. This is a design target. We will publish live status metrics once the Hub is live.

Request the security pack

A short form for reviewers.