Security and data protection
Your operatives' records, certificates and photos are personal information. Here's where they're kept, who can see them and how they're protected.
- Held in the UK
- The database, sign-in and every certificate and photo are held in London, with a backup copy of certificates and photos in the EU. Services outside the UK only get what they need to do their job: an email address to send a reminder to, a phone number to text, a card payment, or for smart features, a spreadsheet's column headings and the words of a search.
- Each company only sees its own records
- The separation between customers is enforced by the database itself, not just by the app's screens, so a mistake in the app can't show one company another's data. Automatic tests check it on every change before it goes live.
- Departments stay separate too
- A department manager can only see and change their own department's operatives. The same rule covers their reminders, exports and certificate files, and it's enforced in the database in the same way.
- Certificates and photos are private
- Files are stored privately and only ever opened through links that stop working after a few minutes. Every operative photo is re-saved on our servers, which removes its location and other hidden information. The exceptions are a site card, whose photo whoever scans it sees so they can tell it's the right person, and a pack you send a client, which shows the photos and copies you choose to the people you sent it to.
- Site cards show only what a site gate needs
- Scanning an operative's site card shows that day's status, photo, tickets and training, and which tickets were checked against their register and when. Never their contact details, card numbers or certificates. Each card's code is random and can't be guessed, a lost card can be replaced so the old one stops working, and you can switch cards off for the whole company. A trial account's cards only work for its own team until it chooses a plan.
- Packs for clients open only for the people you send them to
- When you send a client the tickets and certificates of the operatives going to their job, each person gets their own link, and opening it on a new device needs a code we email to them, so a forwarded link is no use to anyone else. The link stops working on the day you choose, at most 90 days ahead, or the moment you stop sharing it. You can see every time it was opened and every copy downloaded, and each downloaded copy is marked with who it was shared with and when. A pack can also carry other documents you choose to add, such as plant certificates, shown and marked in the same way and deleted with the pack. Contact details are never included.
- No passwords to leak
- People sign in with a link sent to their work email, so there are no QualTrack passwords to guess, reuse or steal. A check at sign-up and sign-in stops automated attempts.
- Changes are recorded
- Every change anyone makes is logged: who, when and which fields. Owners and admins on the Business plan and above can read the log. Deletions are logged too.
- Our staff can't browse your records
- QualTrack staff need a code from an authenticator app to use our admin tools, and every look is logged. They can only see operative records if your account owner turns on support access, which is read-only, lasts at most 72 hours and can be switched off at any time.
- Card details never reach us
- Payments go straight to Stripe. QualTrack never sees or stores card numbers.
- Error reports without personal data
- When something breaks we get an error report so we can fix it. Names, email addresses, phone numbers and page contents are removed before it's sent.
- AI suggests, a person decides
- On Professional and Business, Claude, an AI model made by Anthropic, suggests which column of an imported spreadsheet is which and turns a search typed as a sentence into filters. It sees only column headings, ticket, training and job role names, and the words searched, never an operative's records, card numbers or certificates. A person checks every suggestion, it never decides whether anyone is cleared, and Anthropic doesn't train its models on what it's sent.
- Backed up every night
- The database is backed up daily, and every certificate, photo and logo is copied each night to private storage in the EU, which checks itself against the originals. If we ever have to restore from a backup, deletions and removed access made since it are re-applied from a separate record.
- Your records are yours
- Export operatives, tickets, the training matrix and every Passport whenever you like, including after cancelling, when the account stays readable. Delete one operative and everything about them from their Passport, or delete your account from Settings and its records go 7 days later. An account that has ended is deleted 12 months after, with a month's warning.
The detail
Our privacy notice and data processing terms set out exactly what we hold, why, for how long, and every company that helps us run QualTrack.
Found a security problem?
Please tell us before telling anyone else, and give us a chance to fix it. Email us with the details and we'll get back to you.