Security and data

1. In one paragraph

Employee data entered into our calculators and bulk tools is processed in the user's own browser and never sent to us. Spreadsheets uploaded for bulk runs are read on the device, not uploaded. What's written in Agree it in writing is encrypted on the device with keys we never hold. Letters exercises run on your own systems under a written data processing agreement. What we do store is limited to purchase records, account details and the minimum needed to run an agreement.

2. Calculators and bulk tools

• Calculations, PDFs, Word letters and spreadsheets are all produced in the browser.
• Bulk costing and pay review templates are read and written on the device. No employee row reaches our servers.
• Paid downloads are unlocked by a server check against the payment record, never by a setting in the page.

3. Every Letter Right exercises

• Live employee data is processed only on your own systems and devices, using Microsoft tools you already have.
• We build and test on dummy data, and every letter is checked against the source before it's issued.
• A written data processing agreement is signed before any live data is used.
• Working files are deleted at the end of the exercise on a date we agree, and we confirm it in writing.

4. Agree it in writing

• Content is encrypted in the browser (AES-GCM). The key is held only in each person's private link and never reaches our servers.
• We store names, email addresses and progress, so we can send reminders. Reminder emails contain no links and no content.
• Each person's access token is stored only as a hash. Lost links can be replaced, and the old one stops working at once.
• Agreements are deleted 90 days after they close, or 180 days after they go quiet.

5. Platform and payments

• Hosting and database: Lovable Cloud (Supabase). The database can only be reached through our own server functions, with row-level security on every table.
• Payments: Stripe, which is PCI DSS Level 1 certified. We never see or store card details.
• Email: Resend, for receipts and reminders only.
• The owner account uses two-factor sign-in, and there are no shared logins.
• No advertising or tracking cookies, and no tools that record what people type.

6. If something goes wrong

We'd tell affected customers without delay and report to the Information Commissioner's Office within 72 hours where the law requires it. Because calculator data never reaches us and agreement content is encrypted with keys we don't hold, a breach of our database would expose contact and purchase details only.

7. Documents for your supplier checks

On request we can provide our data processing agreement, a completed security questionnaire, and details of hosting regions and sub-processors. Email hello@everythingright.co.uk with what your procurement team needs.

See also our privacy notice and terms of use.