Security

Why this page exists

Before a carrier hands over the records the law makes them keep, somebody usually asks how those records are looked after. This page is our answer, including the parts we have not finished. If your own customer sends you a security questionnaire, everything here can go into it.

We are a small company, not a bank, and this page is written that way. Where something is not in place, it is in the list further down rather than dressed up.

Where your data is kept

The systems we run ourselves are hosted in the European Union: the Netherlands for the application and the database, which is where your account and your waste records live. Documents and photos sit in a data centre elsewhere in the EU. Our storage provider guarantees the EU rather than one named country, so we can't tell you which one. The UK government has decided that EU countries protect personal data to the UK's own standard, so keeping UK data there is lawful.

Three of the companies we rely on handle data in the United States. Resend sends our email, so it handles the address a message goes to and what's written in it. Stripe takes subscription payments, so it handles your billing details. For those two we rely on the standard contract the UK government publishes for sending personal data abroad, called the UK Addendum to the EU Standard Contractual Clauses: a fixed set of terms that binds the company receiving the data to protect it to the UK's standard. Cloudflare counts visits to our public website in its data centres in the United States and Europe, and uses your IP address only to work out which country you're in. All three companies are certified under the UK extension of the EU-US Data Privacy Framework, a scheme the UK government recognises for sending data to the United States.

Our sub-processor list names every company that handles data for us and the country each one holds it in, and our privacy notice covers what we collect and why. We’re registered with the Information Commissioner’s Office, the UK’s data protection regulator, under number ZC240267.

If a questionnaire asks you to name the country, this is the answer to write. The application and the database are in the Netherlands. Documents and photos are elsewhere in the European Union, under a contract that guarantees the EU without naming a country. Email is handled in the United States by Resend and payments by Stripe, both under the UK Addendum to the EU Standard Contractual Clauses. Send the form to us if it will not take that, and we will fill it in ourselves.

How we protect it

• Your data is encrypted while it travels between your browser and us, and it stays encrypted on the disks our providers run. Railway encrypts the database and Cloudflare encrypts every stored file.
• One company's records are kept apart from another's by the database itself, using a rule called row-level security. Somebody signed in to a different account cannot read your rows, even if our own code has a bug.
• Every request inside the app has to carry a valid signed-in session before it reaches the database. A few pages work without an account, like the free transfer-note tool and the contact form; those take what you type into them and can reach nothing that belongs to an account.
• A waste transfer note cannot be deleted before the two years the law requires. That rule sits in the storage rather than in the software, so an update to the app cannot get round it and neither can we.
• Only the two people who run CarrierNote can reach live customer data, and anything either of us changes on an account is written to a log that cannot be edited.
• Passwords are stored scrambled, so nobody here can read yours, and repeated sign-in attempts are slowed down. We never handle your password: somebody you invite sets their own from a single-use link, and a manager cannot set one for them.
• A password has to be at least twelve characters, and a new one is checked against public lists of passwords already known to have leaked elsewhere — only a short scrambled fragment of it is ever sent for that check, never the password itself.
• In the mobile app, a note captured with no signal is held on the phone until it reaches us. Signing out clears every note still waiting there, with its photos, so a shared phone doesn't keep the last person's collections. Let a note sync before you sign out.

How the software is looked after

• The outside code we build on is updated every month, and a big version change is looked at on its own rather than slipping through with the small ones.
• Every change is read by one of us and put through a set of automatic checks before it ships.
• Every change runs on a practice copy of the service before it runs on the one you use.

What we have not done yet

The things a buyer asks about that we cannot claim today. Each one is on our own list, and this page changes on the day the work lands rather than the day we plan it.

If your customer asks you for one of these by name, tell them we do not hold it and send them this page. Where they need more than that, we answer their questions in writing, and the timescale is at the bottom of this page.

• No backup promise. The database is hosted on Railway and we are still establishing exactly what its backups cover and how long a restore takes. Until we have restored from one ourselves, there is nothing here to rely on. And a record nobody can delete is not the same as a record we can get back, so the two-year rule above is not a backup.
• No independent penetration test. Nobody outside the team has been paid to try to break in.
• No ISO 27001 or SOC 2 certificate. Both audit a company's paperwork as much as its software, and we have not bought either.
• No two-factor login. You sign in with an email address and a password. If your own rules need a second step at sign-in, tell us before you buy: what customers need is what decides when we build it.
• No live status page. The status page in the app tells you how we handle an incident, but it does not yet report whether the service is up.

Telling us about a security problem

Email support@carriernote.co.uk and put the word Security in the subject line. Tell us what you found, how to reproduce it, and what you think it would let somebody do. If you use a tool that looks for one, the standard pointer file is at /.well-known/security.txt.

What we ask of you

• Test against your own account and your own data, never anyone else's.
• Do not read, change, or delete data belonging to another company. If you reach some by accident, stop and tell us what you saw.
• No denial-of-service testing, no bulk automated traffic, and nothing aimed at our staff or our customers by email or phone.
• Give us a fair chance to fix the problem before you write about it publicly. Tell us the date you plan to publish and we will work to it.

What we will do

• We acknowledge your report within one working day, counting working days rather than weekends and bank holidays.
• We tell you what we think it is, whether we agree it is a problem, and roughly how long a fix will take.
• You hear from us again when it is fixed, and we will credit you by name if you would like us to.
• If personal data was exposed, our incident procedure runs and any customer whose data is involved hears from us within 24 hours of us finding out. That window is real hours, weekend or not, unlike the working days above.
• We treat a report that follows this policy as help rather than an attack, and we will not bring a claim against you for it.

What counts, and what does not

This policy covers CarrierNote's own site, app, and API. A problem in a service we buy from somebody else, such as our hosting or our email provider, should go to them, and we would be glad to know as well.

We do not pay for reports. There is no bug bounty here, and we would rather say so than leave you guessing. Send us a scanner's output by all means, and tell us what you think it means for our customers' data, because that is the part a scanner cannot tell us.

Questions from a buyer

If a council or a large customer asks you to have us fill something in, send it to support@carriernote.co.uk. We answer a written question about how data is handled within 10 working days and complete a standard security questionnaire within 20 working days. Both promises are in our data processing agreement, the contract UK data protection law requires between you and anyone handling personal data on your behalf. There is one on this site and it applies to every account.

One answer worth having before you need it. If a breach touches the records you hold about your own customers, the report to the Information Commissioner's Office is yours to make, because that data is yours and we only hold it for you. Our job is to get you what you need for it inside your own 72-hour deadline, which is why we promise you the facts within 24 hours. Where the breach is in data we hold in our own right, such as your account or an email to support, the report is ours.