Security and data protection at Passdesk.

Where your data lives

Your school's data is stored and primarily processed in the United Kingdom: the database runs in a London region and the application servers run in Google Cloud's europe-west2 (London) region. To run the service we also rely on a small set of established sub-processors — some of them US-based, such as our payment, email and SMS providers — which process limited personal data outside the UK. Those transfers are protected by appropriate UK GDPR safeguards; see International transfers below.

Passdesk Ltd (registered in England & Wales, company number 17193377) is the data processor acting on each school's instructions; each school is the controller for its learners' and staff data. Solo learners contract with Passdesk directly. Passdesk applies the UK GDPR and the Data Protection Act 2018, and the EU GDPR (Regulation (EU) 2016/679) where a school or learner is established in the EU or EEA.

Encryption

Data is encrypted in transit over TLS 1.2+ (HSTS preload), and at rest at the database and storage layer using our hosting providers' managed encryption. Passwords are stored as bcrypt hashes, so nobody can read them back, including us. Card details never touch our servers: all card data is tokenised and handled by our PCI-DSS Level 1 certified payment provider.

Access control

Access inside the product is role-based: a school's data is visible only to that school's own staff and to Passdesk support acting on the school's instructions. Each tenant's data is scoped at the query layer so one school can never see another's records. Sign-in is protected by per-IP rate limiting and a managed bot challenge, and admin actions are written to an internal audit log.

Day-to-day, production access is held by Passdesk and the small set of managed services listed below.

Backups & resilience

The production database runs on a managed Postgres provider with automated, encrypted backups and point-in-time recovery. Hosting and content delivery run on Cloudflare's global network. As an early-stage product we don't yet commit to a formal recovery-time objective — if that level of guarantee is a procurement requirement for you, talk to us before you commit.

Sub-processors

We use a small set of established providers to run the service. Each only processes the data needed for its function:

• Neon — managed Postgres database hosting (UK region).
• Google Cloud — application server compute (Cloud Run, London region).
• Cloudflare — CDN, edge hosting, DNS, and bot protection (processes IP addresses); also stores the files you upload — expense receipts and lesson photos or voice notes — in its R2 object storage.
• Stripe — payment processing and card tokenisation (PCI-DSS Level 1).
• Postmark — transactional email (password resets, invites, receipts).
• Twilio — SMS notifications, where a school opts in to send them.
• Sentry — error and performance monitoring (production only; event data held in Sentry's EU region; payloads are scrubbed of personal data).
• Google — maps on address and route screens, and optional Google Calendar sync where a school connects it.
• Microsoft — optional Outlook calendar sync where a school connects it.
• Anthropic — the AI model behind product import from a school's own web page, and behind AI lesson summaries where a school switches them on (those send the learner's first name, skill scores and the instructor's notes). It's also the model behind the in-app help assistant, which receives the questions people type into it, with any card numbers removed first. Anthropic's terms bar it from training on customer content, and we contract through its Irish entity.
• Upstash — a managed cache holding sign-in and messaging rate-limit counters keyed by IP address. It never holds records.
• Ideal Postcodes — UK postcode-to-address lookup on address forms. A UK-operated, Royal Mail PAF-licensed reference-data lookup that receives only the postcode you type, not a processor of learner records.
• Companies House — business-verification lookups. A UK public register queried directly, not a processor acting on our instructions.

We'll give you reasonable notice before adding a new sub-processor that handles personal data. For the current authoritative list or a signed data processing agreement (DPA), email [email protected].

International transfers

Your data is stored and primarily processed in the UK. Several of the sub-processors above are based in the United States — our payment provider (Stripe), email provider (Postmark), SMS provider (Twilio), maps and calendar features (Google and Microsoft), our CDN, bot protection and file storage (Cloudflare), the rate-limit cache (Upstash), and the AI model provider (Anthropic, contracted through its Irish entity). Sentry keeps its event data in the EU. Where they process personal data outside the UK, those transfers are covered by appropriate UK GDPR safeguards — the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or, where the provider is certified, the UK Extension to the EU–US Data Privacy Framework. We send each provider only the minimum personal data its function needs.

For a school or learner in the EU or EEA, sending data to us is itself a transfer to a third country. It runs on the European Commission's adequacy decision for the UK (Implementing Decision (EU) 2021/1772), renewed on 19 December 2025 and in force to 27 December 2031, with the Standard Contractual Clauses in Commission Decision (EU) 2021/914 as the fallback if that decision lapses. Your rights, and which authority to complain to, are set out under If you're in the EU or EEA in the privacy policy.

Your data — export & deletion

Your data is yours. You can export your records at any time from inside the app, and request correction or erasure whenever you want. The full set of rights under the UK and EU GDPR, the export route, and the retention periods we apply are set out in the Your rights section of our privacy policy. If you cancel, you take your students, payments, rubric, and routes with you.

If something goes wrong

We're registered with the UK Information Commissioner's Office (ICO), registration number ZC142229. If we ever became aware of a personal-data breach that posed a risk to individuals, we would investigate promptly and notify the ICO within 72 hours where the UK GDPR requires it, and tell affected controllers and individuals without undue delay. Schools acting as controllers will be kept informed so they can meet their own notification duties — for a school in the EU or EEA that means notifying its own supervisory authority, such as the Data Protection Commission in Ireland.

Vulnerability disclosure

Found something? Email [email protected]. Good-faith researchers won't face legal action, and we're happy to credit you publicly if you'd like. For compliance questions, a DPA, or the current sub-processor list, get in touch at [email protected].