Your workshop's data, properly looked after.
Client records, vehicle histories and inspection media are commercially sensitive and legally regulated. Here is specifically how they are protected.
What is actually enforced.
Not aspirations — the mechanisms operating in the platform today.
Tenant isolation
Every query is scoped to the company that issued it. One workshop cannot read another's clients, orders or media, regardless of how a request is constructed.
Role-based permissions
Access is granted per role and per capability rather than by broad tiers, so a technician sees their work and an owner sees the business.
Password handling
Passwords are stored as salted hashes and are never recoverable in readable form — not by us, not by support, not by an administrator.
Session management
Active sessions are listed in your profile with device and location context, and any of them can be revoked immediately.
Step-up authentication
Sensitive administrative actions require re-entering your password, so an unattended logged-in screen is not a master key.
Encryption in transit
All traffic between your browser and the platform is encrypted. Uploaded media is served through access-controlled URLs rather than public links.
Automated backups
The database is backed up on an automated schedule and stored separately from the live system, with restoration tested rather than assumed.
Change history
Order and record changes are attributed to a user and a timestamp, giving you an audit trail when a dispute needs resolving.
GDPR, and what it means for you.
Workshops handle personal data about their clients. That makes each workshop a data controller — and makes our job to give you the tools to meet those obligations rather than getting in the way of them.
- You remain the controller of your client and vehicle records; we process them on your instructions
- Export your data at any time, in a portable format
- Deletion requests honoured within the retention periods published in our Privacy Policy
- Sub-processors disclosed, with transfers covered by Standard Contractual Clauses where applicable
- Breach notification to the supervisory authority within 72 hours, and to you without undue delay
- AI providers contractually barred from training on your content