Back to Home

Data Security & Protection Statement

Last updated: July 2026

UK SEND Compass is built on the Base44 platform, which is SOC 2 Type II certified and ISO 27001 certified. All user data is encrypted at rest and in transit, protected by row-level security, and access-controlled through secure authentication. This page sets out exactly what measures are in place and how your data is handled — so you can use the platform with confidence.

Our Commitment to Honesty

We believe in being transparent about what we can and cannot guarantee. While your data is protected by industry-standard security measures, it is not end-to-end encrypted — meaning the Base44 platform can access data if strictly necessary for support or legal compliance. We will never misrepresent our security posture.

1. Platform Certifications

  • SOC 2 Type II certified — independently audited for security, availability, and confidentiality
  • ISO 27001 certified — international standard for information security management
  • All data tables are encrypted at the platform level — no additional configuration required
  • Regular security scanning detects permission gaps, exposed credentials, and package vulnerabilities

2. Data Encryption

  • Encryption at rest: All data stored in the database is encrypted at the platform level
  • Encryption in transit: All data sent between your device and our servers uses HTTPS/TLS encryption
  • Private files (e.g. uploaded documents) are stored in a separate private storage and only accessible via time-limited signed URLs

What this means: If someone intercepted your data while it was being sent, or physically accessed the database, it would be encrypted and unreadable. However, data is not end-to-end encrypted — the platform itself can decrypt data when necessary (e.g. for support requests or legal compliance).

3. Authentication & Access Control

  • Secure session tokens: Login sessions are managed through cryptographically secure tokens — passwords are never stored in plain text
  • OAuth providers: Google sign-in available, with support for Microsoft, Facebook, and Apple
  • Role-based access: Only admin users can access admin-only areas; standard users see only their own data
  • Service-role separation: Administrative operations use a separate service-role context, distinct from user-level access

4. Row-Level Security (RLS)

Your most sensitive data is protected by row-level security — a database-level rule that ensures only the account holder who created a record can read, edit, or delete it. No other user can access it.

  • SEND Passports: Only the creator can view, edit, or delete — not even platform staff can access without explicit approval
  • Family Management data: Calendar events, diary entries, and sensory logs are locked to the account owner
  • Appointments: Only visible to the account holder
  • Passport sharing: Requires explicit per-request approval — recipients must submit a request and you must approve it before any data is disclosed

Bottom line: Another user of the platform cannot see your data — not your passports, not your diary, not your appointments. RLS is enforced at the database level, not just in the app interface.

5. Payment Security

  • Payments are processed by Stripe, which is PCI DSS Level 1 compliant — the highest level of payment security certification
  • Card details never touch our database — they go directly to Stripe's secure infrastructure
  • We only store transaction metadata (e.g. plan type, status) — never card numbers, CVVs, or full card details
  • Subscription management and refunds are handled through Stripe's secure customer portal

6. Data Sharing Policy

The Honest Answer

We never sell your data. However, it is not true that no data ever leaves the platform. A small number of vetted third-party providers process data as part of delivering specific features. Below is exactly who receives what.

  • Stripe: Payment processing — receives transaction and billing metadata only. No passport, health, or personal profile data is ever sent to Stripe.
  • Resend: Transactional email delivery — receives the email address and message content needed to send emails you've requested (e.g. contact form replies, share request notifications, reminders).
  • ElevenLabs: Text-to-speech audio generation — receives the text you ask to be spoken aloud. This could include personal content if you enter it into the text-to-speech tool.
  • AI / LLM Provider: Generates the Lost & Found emergency breakdown and powers the Buddy agent — receives relevant passport or conversation data needed to produce a response. Data is sent securely and is not used for model training.
  • Law enforcement / courts: Only where legally required by a court order or statutory obligation.

Children's sensitive data (SEND Passports, diary entries, sensory logs) is never shared with advertisers, sold to data brokers, or used for profiling. It is only sent to the AI/LLM provider when you (or someone you've shared the passport with via QR code) actively trigger the Lost & Found emergency feature.

7. What We Do Not Do

  • We do not sell your personal data to any third party
  • We do not use your data for advertising or profiling
  • We do not use tracking or advertising cookies
  • We do not share SEND Passport or health data with any third party unless you explicitly trigger a feature that requires it (e.g. Lost & Found emergency info)
  • We do not store your card details — they go directly to Stripe
  • We do not allow other platform users to see your private data

8. Your Control

  • You can delete your SEND Passports, diary entries, and all personal data at any time
  • You can revoke passport sharing by denying access requests or deleting the passport
  • You can request a copy of all data we hold about you (UK GDPR right of access)
  • You can withdraw consent at any time — deletion is permanent and irreversible

For full details of your rights under UK GDPR, see our Privacy Policy.

UK SEND Compass · Data Security Statement v1.0 · July 2026 · Built on Base44 (SOC 2 Type II & ISO 27001 certified)