Security and data

Written for the person who has to sign this off

You will be asked where the data is held, who can reach it and how long it is kept. Here are the answers, without the badge wall.

What we commit to

Each of these is true of the product today rather than something on a roadmap.

  • Data at rest is held in the United Kingdom or the European Union.
  • Everything travels over an encrypted connection, and connections are encrypted at rest too.
  • No passwords exist anywhere in the product, for administrators or for subscribers.
  • Sign-in links are single-use, expire in twenty minutes, and are never stored in a usable form.
  • Every administrative change is written to an audit log you can read and export.
  • Public forms are rate-limited and protected against automated abuse.
  • The people on your lists can export or erase their own data without asking you.
  • We never send marketing to the people on your lists, and never sell or share them.

The questions we are actually asked

Do you store passwords?
No - none, anywhere, for anyone. Subscribers never have an account at all. Administrators sign in with a single-use link sent to their work address. There is no password database to leak and no reset process to attack.
How do the sign-in links work?
A link is valid once and expires after twenty minutes. The link itself is never written down: we keep only a one-way cryptographic hash of it, so a copy of our records would yield no working links. Using a link consumes it immediately, so a forwarded or intercepted copy is already spent.
Can one customer see another's data?
No. Every request is limited to the organisation resolved from the signed-in person's own membership record. That is never taken from a web address, a form field or a request header, so there is no value an attacker can alter to reach somebody else's list. Asking for a record belonging to another organisation returns exactly what asking for a record that does not exist returns, so identifiers cannot be probed for existence.
Who on your side can see our lists?
Access to production data is limited to the people who operate the service, and is used only to operate, support and secure it. We do not read list contents for any other purpose, and we never use them to market to the people on them.
What do you keep about the people on our lists?
Their email address, the answers they gave to your questions, and a record of each time they opted in, changed something or unsubscribed. That consent record includes the address and browser the action came from, because that is what makes it evidence rather than an assertion. Nothing else - no tracking pixels, no behavioural profile, no advertising identifiers. Our own marketing site counts page views in a way that sets no cookie and receives nothing that identifies a person. We are notified when a page breaks, and that notification is configured to carry no network addresses and no form contents.
How long do you keep it?
As long as you decide, and you can remove anything at any time. On top of that, requests to join that were never confirmed are removed after 30 days, and records people erase themselves are held for 30 days so an accident can be undone, then removed for good. Your audit log is kept for as long as your account exists. When an account ends it becomes read-only, and everything is deleted 60 days later and gone from backups within a further 35 days.
Can people get their own data out, or have it removed?
Yes, without asking you and without an account. From the same link they used to sign up, anyone can export everything held about them or erase it outright. You can also export any list, at any time, as a spreadsheet file.
Do you send our newsletter?
No, and that is deliberate. We hold the list; you keep sending with whatever you use today. The only messages we send to your people are the sign-in links they ask for and, when you choose to send one, a request to check their details are still right. There is no campaign history of yours for us to hold.
What happens to addresses that bounce?
A suppression list is maintained, and the importer refuses to add an address on it, so an address known to be bad cannot be reintroduced by a later upload. Addresses that fail repeatedly are marked on the record so you can see them and clear them out.
Is it backed up, and has the restore been tested?
Yes to both. A copy is taken every night, held encrypted for 35 days and then removed automatically. It is written using a credential that can reach that one destination and nothing else. The restore is rehearsed against a real copy rather than assumed to work: an empty database, brought up to date, loaded, and compared table by table.
Is data ever transferred outside the UK or EU?
Everything at rest - the database, the exports, the files you upload and the nightly copies - is held in the United Kingdom or the European Union. Card payments are handled by a payment provider that operates internationally under standard contractual clauses; card details go directly to them and never reach us. The processors we rely on, what each is for and where each operates are listed in full on our sub-processors page.
What certifications do you hold?
None yet, and we would rather say so than imply otherwise. We are in early access. Formal certification audits an organisation with customers and a track record, so it is something we will pursue once there is a year of operation to examine rather than a claim to make now. Everything described on this page is in place today and can be demonstrated.

Who else touches the data

We rely on a small number of other companies to run the service - to send your sign-in links, to take payment, and to keep the nightly copies. Each one, what it is used for and the country it operates in is listed on our sub-processors page, and our data processing agreement sets out the terms on which they are engaged. If that list changes we will tell you at least 30 days before it does, not after.

Found something?

Tell us before you tell anyone else and we will work with you. Our contact details are published at /.well-known/security.txt in the format described by RFC 9116, or write to security@signedup.io. We will acknowledge a report within two working days. Testing the service itself needs our written permission first, as our acceptable use policy explains.

For data protection questions, including subject access requests, write to privacy@signedup.io.