Security, compliance and GDPR

You shouldn't need to be a security expert to run a training business, a studio or a clinic. We host, patch, back up and watch everything we build, to the same standard whether you're one person or a group of clinics.

There's no security add-on and no compliance tier. It's all in the one monthly bill.

Keeping people's data for longer than you need it is a GDPR problem waiting to happen. Our software clears out what it no longer needs on a schedule, out of the box.

We set that schedule to your policies: how long you keep learner records, bookings, enquiries and the rest. You tell us the rules once, and the software keeps to them.

What we build and host complies with UK GDPR, EU GDPR and the California Consumer Privacy Act (CCPA). So when a customer asks what happens to their data, you've got a good answer:

• it's stored in the UK, and encrypted wherever it is
• it's only used to run your service - no advertising, no selling it on
• if someone asks to see their data or have it deleted, we help you answer inside the legal deadline
• no cookies beyond the ones the site needs to work, unless you turn analytics on - and then only with the visitor's say-so, which we record

When we look after your customers' data, we're your data processor, and the law says that needs a written agreement. Ours comes with every project, ready to sign, with a list of every company we use to deliver the service.

Got your own template, or a sector with its own rules? We'll work from your agreement or put together a tailored one with you.

A lot of what we build touches health data: staff health and immunisation records, medical details on a booking, the records a clinic keeps for its regulator. UK GDPR calls this special category data and expects extra care with it.

We know how to do that properly, so we do it for everyone. Every customer gets the controls special category data needs - UK-only storage, encryption, strict separation from every other customer, a record of who changed what - with no weaker standard for anything else. If something ever went wrong, you'd hear from us within 48 hours, in time to meet your own 72 hours to the Information Commissioner's Office (ICO).

It's our job to keep yours and your customers' data safe.

Not everyone visiting your site has perfect eyesight, a steady hand or the latest laptop. Everything we build is checked against WCAG 2.2 AA, the accessibility standard UK public bodies are held to, and built to work with screen readers, a keyboard alone and text zoomed right up, on any screen from a small phone to a big monitor. It's the right thing to do, and it means fewer people give up halfway through a booking.