Security and data protection
Plain answers about where your data is kept, who can see it and what happens to it. No badges we haven't earned, no numbers we can't stand behind.
Hosted in London
Production data lives with Supabase in the London (eu-west-2) region on AWS.
Your business, your data
Row-level security on every table means an organisation only ever sees its own records.
Sign-in by Clerk
Modern sign-in with Clerk, including two-factor options.
Cards handled by Stripe
Card payments go through Stripe. SortedMate never stores card numbers.
Where your data lives
Your production data is hosted by Supabase in the London (eu-west-2) region on AWS. It stays in the UK.
Data is encrypted in transit using TLS, and encrypted at rest by the hosting providers. The full list of companies that process data on our behalf, where they are and how any transfers are protected is kept on the sub-processors page.
Who can see it
Every table in the database is protected by row-level security. Each query is checked against the organisation it belongs to, so your business only ever sees its own customers, quotes, jobs and invoices. There is no shared view across businesses.
Inside your business, roles decide what each person can see and change, so an apprentice or a subcontractor doesn't need the same access as you.
There's one person behind SortedMate, so the list of people who can reach production data is short: Josh, and the hosting providers listed above. That access is used to keep the app running and to help you when you ask.
How you sign in
Sign-in is handled by Clerk, a dedicated authentication provider, rather than something we wrote ourselves. That gives you modern sign-in with two-factor options, and it means SortedMate isn't in the business of storing passwords.
Two-factor is optional and worth turning on. If you run a team, ask them to do the same.
Payments
Card payments, whether that's your subscription or a customer paying an invoice through SortedPay, are handled by Stripe. Card details go straight to Stripe and SortedMate never stores card numbers.
Billing, cancellation and refunds are covered in the terms of service.
Backups and reliability
Backups and the underlying infrastructure are managed by our hosting providers as part of the services we pay for.
We're not going to quote an uptime percentage we can't stand behind. If the app is unavailable, email hello@sortedmate.com and it goes straight to the person who can fix it.
Your rights
SortedMate Ltd is a UK company and UK GDPR applies. You can export your data and you can ask for your account and its data to be deleted. The privacy policy sets out what we collect, why, and how long it's kept.
The data you hold about your own customers is processed on your behalf under our data processing agreement, which covers your obligations and ours.
What we don't claim
We don't currently hold ISO 27001, Cyber Essentials or a third-party penetration test certificate, and we won't put a badge on this page until we do. If that changes, it'll say so here, with the date.
Reporting a problem
If you think you've found a security issue in SortedMate, email hello@sortedmate.com with what you found and how to reproduce it. You'll get a reply from the person who can fix it, and we'll keep you posted on what happens next.
Please don't access, change or delete data that isn't yours while testing.
Still got a question?
Ask it on the contact page and you'll get a straight answer from the person who built the app.
Contact us