Your figures, under your control.

Inside the European Union: the application, the database and every backup. Every provider involved is listed, with its location and purpose, in our data processing agreement. That is where the list carries contractual weight, and where you gain the right to be notified before it changes.

It is encrypted on the way from your browser to us, between our own services, at rest, and in every backup. The database is not reachable from the internet; only the application can talk to it.

It is read in your own browser, and the file itself is never transmitted to us. Only the extracted figures are sent. That removes a whole category of risk: there is no uploaded document on our side to be lost, leaked or misused.

Without passwords - none is ever created, transmitted or stored. On first login the user receives a single-use code at their verified email address, then sets up a passkey on their device. From then on the passkey is the key: phishing-resistant, with no shared secret that can be intercepted or replayed.

Your administrators can make passkeys mandatory for administrators or for everyone. Where a device cannot support passkeys and you have not made them mandatory, the email code remains available.

They sign in with a single-use code to their verified address and set up a new passkey. That step on its own opens nothing.

A new passkey locks their access until one of your administrators approves them back in. Someone who has taken over a mailbox ends up with a session and no figures.

The product has no impersonation or "view as customer" feature. A small number of statycs engineers hold infrastructure access for operating the platform, each authenticated individually. No external contractors are granted access.

No. Development and test environments never contain production data. They run on generated data, so a mistake in a test environment cannot expose a real figure of yours.

Your data is never sold. Under our standard terms, anonymised and aggregated figures may be used to produce industry benchmarks, and you can opt out of that at any time - the terms set out exactly how. Negotiated agreements can exclude it outright, and several do.

Identifiable figures are never shared with anyone. Where a contract requires a stricter commitment than the standard terms, that belongs in the agreement rather than on a web page, and we are happy to write it in.

Encrypted backups are kept in at least three separate locations. Recovery is a defined process, and we rehearse a full disaster recovery at least twice a year so it works when it is needed. Recovery commitments are set out in the contract - ask us if your reporting calendar has specific requirements.

Without undue delay, as our data processing agreement sets out. Art. 33(2) GDPR sets no risk threshold on a processor notifying the controller, and we apply none - you hear about it, and you decide what it means for your own filing.

The notification carries the nature of the breach, the categories and approximate number of people affected, the likely consequences, what we have already done, and a named contact - in time for your own 72-hour deadline to the supervisory authority.

Your files never leave your computer. We only ever receive the figures extracted from them, so the original files stay with you the whole time.

The figures you can export at any time, in machine-readable form - Excel and CSV directly from the product, and a full structured export on request. On termination your data is deleted, subject to any statutory retention you instruct us to observe as controller.

Write to [email protected]. We acknowledge receipt, come back to you with an assessment, and we will not pursue anyone who reports a genuine finding in good faith.