Security and data residency
You are trusting us with home addresses, key-safe codes and the welfare records your licence depends on. This page says exactly where that data lives and what protects it. Everything here describes the system as it runs today.
Where your data is
Your records, your files and the application itself are in the UK or Western Europe and are not replicated to the United States. The one exception is transactional email, and we would rather spell it out than round it off: Resend dispatches our email from Ireland, but stores message content, metadata and delivery logs in the United States. That covers the address a sign-in link went to, and the text of a booking reminder, which can name a dog and list what is missing from its profile.
| What | Where |
|---|---|
| Your records — clients, dogs, bookings, care logs | Postgres (Neon) in London, AWS eu-west-2, with continuous backup and point-in-time restore in the same region |
| Uploaded files — vaccination cards, policies, photos | Cloudflare R2, EU jurisdiction |
| The application itself | Railway, EU West |
| Transactional email — sign-in links, booking reminders, inspector access grants, waitlist offers, and the copy of each pilot or waitlist application sent to our team | Resend. Dispatched from Ireland (eu-west-1), but Resend stores message content, metadata and delivery logs in the United States, under the UK Addendum to the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework (UK extension). |
| Error monitoring | Sentry, EU ingest, with personal data stripped before it is sent |
| Analytics | Cloudflare Web Analytics on the public pages only, where it is switched on. It sets no cookies and does not identify visitors. The signed-in application has no analytics at all. |
Every supplier that touches your data, what it does, where it does it and under what transfer safeguard, is on our subprocessor list. We give at least 14 days' notice by email before adding to it or changing it.
How it is protected
One organisation can never see another
Every table carries an organisation id and row-level security is enforced by the database, not by application code remembering to filter. The account the application connects with is not permitted to bypass it, and the system refuses to start in production if that ever stops being true. We keep an automated test whose whole job is to attempt to read another organisation’s data and assert that it fails.
Key-safe codes and access instructions are encrypted individually
They are encrypted at field level with AES-256-GCM, so they are unreadable even to someone holding a copy of the database. They are stripped from every export, and every single time one is revealed it is written to the audit trail with who looked and when.
Records are not deleted out from under you
Deletion is always soft first. The audit trail is append-only and written by the database itself, so it cannot be quietly rewritten by the application. Care logs become immutable after 24 hours — a correction is a new entry that references the original, which is how a record survives being questioned.
Records are kept for at least three years
The statutory retention floor is enforced in the deletion path, not in a policy document. Even an erasure request preserves the minimum statutory register fields, because those are records you are required to hold.
Records are backed up continuously
The database runs on Neon Postgres in London with continuous backup and point-in-time restore, so recovery is to a chosen moment inside the retention window rather than to a nightly snapshot. The restore window and the log of restore drills are kept in our operations runbook, and both are available to any customer on request.
Uploaded files are checked and fingerprinted on arrival
Every upload is content-checked when it lands: the bytes are inspected rather than the filename trusted, an executable is refused whatever it is called, and the file is fingerprinted with a SHA-256 hash that is listed against it in your export. Files are served only through short-lived signed links, never a public address.
No client personal data in our logs or analytics
Owner names, addresses and contact details never appear in application logs, error reports or analytics. Error reports are scrubbed before they leave the server.
Sign-in without passwords to lose
Sign-in is by emailed single-use link, or Google or Microsoft where you use them. Sessions are held in secure, http-only cookies — never in browser storage where another script could reach them. We never store a password, because we never ask for one.
What we will never do
- We do not sell your data, or your clients’ data, to anyone.
- We do not use your records to train machine-learning models.
- We do not take a commission on what your clients pay you.
- We do not hold your records hostage: if you stop paying, they stay readable, printable and exportable.
Being straight with you
Two things we would rather you heard from us than found out later. The first is virus scanning of uploaded files. Every upload is content-checked and fingerprinted on arrival, and a file that fails a virus scan attempt is held back — it cannot be downloaded until it has been scanned successfully. When a scan runs, it runs against a scanner we operate ourselves rather than a third-party scanning service, because sending a photograph of a client's home to someone else in the name of checking it would be a disclosure, not a control. Where no scanner is configured, a file is recorded as unscanned rather than quietly marked clean, and that status is shown against the file. We would rather show you an honest “unscanned” than a dishonest “clean”.
And DogBoarder is a young product. We have not yet been through an external penetration test or a formal certification, and we would rather say so than imply one. What we can point at is the design above, which was built this way from the first commit rather than retrofitted.
Data protection
For your clients' personal data you are the data controller and we are your processor. Our data processing agreement sets out that relationship in full and forms part of our terms. Our privacy notice explains what we do with personal data and how to exercise your rights, and the subprocessor list names everyone who processes data on our behalf.
Security questions, or something you think we have got wrong, go to hello@dogboarder.uk. If you believe you have found a vulnerability, tell us there first and give us a reasonable chance to fix it — we will not come after anyone acting in good faith.
Company
DogBoarder is operated by PromptWorks AI Ltd, a private limited company registered in England and Wales, company number 17305850. Registered office: 66 Paul Street, London, England, EC2A 4NA. We are registered with the Information Commissioner's Office under reference ZC229196. Contact hello@dogboarder.uk.