Security & data

Status — September 2026

Adminalyse is an early-stage product with no paying customers yet. This page describes how we are building the service to work — not everything on it is finished. In particular, the bring-your-own-storage model described below is in active development and not yet available. Until it ships, your data is held in our encrypted UK/EU database (details under “Today”). We will update this page as each piece is released. If anything here matters to a decision you’re making, email security@adminalyse.com and we’ll tell you exactly where things stand.

The principle

Your business is the data controller for your clients’ and staff data. Our aim is that you should also hold that data — in storage you own and control — so that Adminalyse provides the software and you keep the records. The less of your clients’ information we hold, the less there is to lose, misuse, or argue about.

We’re not fully there yet. What follows is split into what is true today and what we are building toward.

Today

Right now Adminalyse works like most business software: your records are stored in our database so the service can do its job. That database and its backups are in the UK/EU.

Where data is stored

Application database and file storage on infrastructure located in the UK/EU (currently Supabase). Backups stay in the same region.

Encryption

All traffic is encrypted in transit (TLS 1.2+). Data is encrypted at rest, including database volumes and uploaded files.

Separation between businesses

Every business’s data is isolated at the database level with row-level security, so one customer’s queries can never read another’s records.

Backups

Automated daily backups with point-in-time recovery.

Access by us

Our team does not access your data except when you ask us to, for support.

Getting your data out

You can export your clients, jobs, quotes and invoices at any time, plus a Sage 50-format export. If you close your account, your data stays available to export and is deleted within 90 days.

What we never do

We do not sell your data, share it for advertising, or use it to train AI models.

What we’re building toward

The next step is to move your records out of our database entirely, into storage you connect and control.

Connected storage

You’ll connect a folder in your business Google Drive, Microsoft OneDrive / SharePoint, Dropbox, or an S3-compatible bucket — chosen by you, in a region you choose.

Where records go

Client records, job notes, photos, quotes and invoices are written straight to your storage. Adminalyse keeps a reference, not the file.

What Adminalyse keeps

Only your account sign-in, your subscription and billing details, and a revocable token to talk to your storage. Nothing about your clients.

If you leave

Nothing for us to export or delete — your data was never anywhere but your storage. Revoke our access and the connection is gone.

This is a significant change to how the product is built, and some features (such as the client tracking portal and automatic invoice chasing) will work differently under it. We’ll be clear about each trade-off as it ships.

Signing in

Sign-in and your account are the one part Adminalyse always holds — even under the model above. We keep this deliberately small: your name, email, a securely hashed password (or a link from your identity provider), and your role. Authentication is handled by Supabase Auth.

Passwords

Stored only as a salted hash — never in plain text, and not visible to us. New and changed passwords are checked against known-breach databases and rejected if they appear.

Two-factor authentication

Available on every account via an authenticator app. We recommend turning it on for the account Owner.

Sessions

You can see where you’re signed in, sign out a single device, or sign out everywhere. Sessions expire and are renewed with short-lived tokens.

Roles

Owner, Admin, Operative and Read-only. Operatives see only their assigned jobs by default. Only an Owner can reach billing or close the account.

Staff invites

Invited by email; the invited person sets their own password. The role on an invite is validated server-side, so it can’t be tampered with to grant more access than intended.

Sign-in cookies

A strictly-necessary authentication cookie keeps you logged in — see the Cookie Policy. No tracking or advertising cookies are used.

Your role under UK GDPR

Your business is the data controller for your clients’ and staff data. Today, Adminalyse is your data processor and stores that data on your behalf; under the model above, we would process it only briefly in your browser and hold none of it. Either way, these remain your responsibilities:

• Registering with the ICO where required.
• Having a lawful basis to process your clients’ personal data.
• Completing a Data Protection Impact Assessment before storing special-category data such as safeguarding or vulnerability notes — a template is provided to start from, but it is not legal advice.

The controller / processor split is set out in the Terms of Service, and how we use cookies in the Cookie Policy.

Reporting a security issue

If you believe you’ve found a security problem, email security@adminalyse.com with enough detail to reproduce it. We aim to acknowledge within one working day. Please don’t run automated scans against the live service or access data that isn’t yours.

We do not currently hold ISO 27001 or SOC 2 certification. We’re a small UK company building carefully; if your procurement needs a specific assurance, get in touch and we’ll tell you honestly where we are.