Security & Trust

In Plain English: It's your data, full stop. I only use it to do the job you've asked me to do.

You are the data controller: you decide what data is collected and why. I act only as your data processor, working on your instructions. This is true wherever the data is hosted, including while it sits in an account I manage during the build.

On request, a Data Processing Agreement sets this out formally.

In Plain English: I only ask for the access I need, and you can switch it off yourself at any time.

When I connect to tools such as Xero, Google Workspace or Microsoft 365, I use access keys or app connections scoped to the minimum needed, never your personal passwords. You keep control and can revoke any connection from your own admin settings.

In Plain English: While we work together I look after things. When we're done, it all moves to you and my access is removed.

During the build, the app and its data may be hosted in an account I manage. At handover, the project and its data are transferred to your own account, and I remove my access. I confirm this in writing with a handover and access removal note.

In Plain English: I won't sell, share or reuse your data, and I don't use it to train AI.

Your data is never sold, shared with third parties for their own purposes, reused on other client projects, or used to train AI models.

In Plain English: Happy to sign an NDA before we even start talking detail.

A mutual non-disclosure agreement is available before any discovery work or meetings with your team.

Every tool we build for your business stores data in a dedicated PostgreSQL database with row-level security (RLS) policies enforced at the database level - not just the application layer. This means access rules are applied directly by the database engine, making unauthorized access practically impossible even if a frontend bug were introduced.

All data is encrypted in transit (TLS 1.3) and encrypted at rest. We never store passwords in plain text - all authentication uses industry-standard hashing.

We support email/password login and social sign-in (Google, Apple) using JWT-based sessions with automatic token rotation. Each user session is scoped to their own data - no user can access another tenant's records.

For admin or sensitive operations, we implement role-based access control with a separate roles table and security-definer functions to prevent privilege escalation.

Our applications run on Cloudflare's edge network with automatic DDoS protection, a global CDN, and auto-provisioned SSL certificates. The backend is built on a serverless architecture that patches the underlying platform automatically - there are no servers to maintain or manually patch.

The database and storage layer is powered by a managed PostgreSQL service with automatic backups, point-in-time recovery, and continuous security updates.

Platform security (infrastructure patching, network protection, encryption at rest) is handled by our hosting providers. Application security (correct access policies, safe secret handling, secure feature design) is our responsibility as the builder.

Your responsibility as the client includes using strong passwords, keeping your own devices secure, and promptly reporting any suspected unauthorized access.

We retain your business data only as long as you are an active customer. Upon request, we can delete your data or export it in a standard format (JSON/CSV) so you maintain full ownership and portability.

Audit logs and backup retention periods are configured on a per-project basis in line with your business needs and any applicable record-keeping requirements.

If you discover a security issue or have a privacy concern, please email us directly. We treat every report seriously and aim to respond within 48 hours.

Contact: security@toolup.biz