Security built into how PlotCare works.
PlotCare handles homeowner details, site activity and contractor data on modern UK-hosted cloud infrastructure with per-tenant isolation.
Built on solid foundations.
The following controls are in place today. We describe them plainly — no marketing inflation.
UK data hosting
All data lives in Supabase (eu-west-2, London region) and is served via Vercel infrastructure. Your data does not leave Great Britain.
ICO registered
PlotCare Ltd is registered with the UK Information Commissioner’s Office. Registration number: ZC204859.
UK GDPR & DPA 2018 aligned
We process personal data under lawful bases defined in UK GDPR and the Data Protection Act 2018, with a documented record of processing activities.
Per-tenant isolation
One customer’s data cannot be returned to another — enforced at the database layer by PostgreSQL row-level security policies.
Encryption
All traffic is encrypted in transit (TLS 1.2+). Data at rest is encrypted by the hosting platform using AES-256.
MFA & role-based access
Multi-factor authentication is available on all accounts. Access inside PlotCare is governed by six defined roles with least-privilege defaults.
What we do not yet hold.
We think transparency matters more than a marketing badge. Here is where we stand on certifications:
Cyber Essentials — planned.
Cyber Essentials certification is on our roadmap. We have not yet started the assessment and will update this page when we do.
SOC 2 / ISO 27001 — not yet certified.
These are on the roadmap as PlotCare scales. We are not certified today and will not claim otherwise.
Your data, clearly explained.
- Where data lives
- Supabase Postgres (eu-west-2, London) for all structured data and file storage. Vercel for serving the application. Resend for transactional email.
- Who can access
- Access requires authentication. Inside PlotCare, six named roles determine what each user can see and do. PlotCare staff can access tenant data only for support or legal reasons, under a documented policy.
- Retention
- We retain personal data for as long as a customer account is active and for a reasonable period thereafter. We will work with you to agree a data retention schedule on request.
- Your rights
- UK data subjects can request access, rectification, erasure, portability, and restriction of processing. Contact us at privacy@plotcare.uk.
- Sub-processors
- Our current sub-processors are: Supabase (database & storage, UK region), Vercel (application hosting), Resend (transactional email), Anthropic (AI extraction, server-side only), and GitHub (source control). A full register is available on request.
We complete security questionnaires and sign NDAs and a pilot DPA.
If your procurement process requires a completed questionnaire, a non-disclosure agreement, or a Data Processing Agreement before a pilot, contact us and we will work through it with you.
Questions about security or data?
Talk to the founder directly. We answer security questions plainly and without a sales pitch.