Security & trust
Your project record is private by default.
You control access. Invite only the people you choose. Revoke access at any time. Choose exactly what gets shared.
Private by default
Project records are not public, not listed and not indexed by search engines. Nothing leaves your Passport unless you deliberately share it.
Role-based permissions
Owner, builder, professional, conveyancer and buyer roles each see only the areas appropriate to them. Access is granted per Passport, not per company.
Controlled sharing
Read-only links limited to selected sections, with optional expiry dates and passwords, revocable at any time.
Audit history
Uploads, replacements, approvals, invitations, permission changes, shares and handover are recorded with the user and a timestamp.
Encryption in transit and at rest
All traffic is served over HTTPS/TLS. Stored data and uploaded files are held on managed infrastructure that provides encryption at rest.
Backups
Records are held on managed database infrastructure with provider-operated backups, so data can be restored following an incident.
Data export
Export your project records and uploaded files, so you are never locked in and can keep your own copy.
Deletion
Delete individual records or close your account. Deleted content is removed from live systems and then from backups in the ordinary backup cycle, subject to lawful retention obligations.
UK GDPR approach
Documented lawful bases, data subject rights handling, written terms with sub-processors and safeguards for any transfers outside the UK.
What we do not claim
Credible, not overstated.
We are asking you to trust us with records that may matter for decades, so we describe only the controls the platform actually provides.
- We do not hold security certifications we have not been awarded.
- We do not claim government, Building Control or Land Registry approval.
- We do not verify workmanship or the authenticity of uploaded documents.
- We do not sell personal data.
Homeowner names, private addresses, invoices, contract values, communications, payment information and personal contact details are never exposed automatically.
QR codes and shared links respect the same permissions as the application and never bypass authentication or sharing settings.
Some capabilities described across the site, including account creation, uploads and live sharing, are delivered progressively as each part of the platform is enabled. Anything shown with demonstration data is labelled as such.