Security and your data

Where your data is kept

• Your records are kept in a MongoDB Atlas database in Ireland, and the servers that run Tippa are in Dublin beside it.
• Photos, signatures and other files you add, such as permit documents and photos of imported notes, are kept in Vercel's storage in London.
• The AI features, reading an imported note and answering questions to Keith, our help assistant, run on Microsoft Azure in the UK (UK South). What they're sent isn't used to train AI models.
• Other services we use, for payments, emails, texts and error reports, are listed in the privacy policy, with what each one receives. Some of them may handle data outside the UK, under the UK's safeguards for international transfers.

Encryption

• On the way. Tippa and this website are only served over HTTPS, and tell your browser never to use an unencrypted connection to them. The connection between our servers and the database is encrypted too.
• Where it's stored. The database and the store for photos and files are both encrypted with AES-256.
• Photos and signatures are private. There's no public link to one: Tippa fetches it only for someone signed in to the organisation it belongs to.
• Passwords are never stored, only a one-way hash of them.

Backups

Your records are backed up once a day, and the last eight days' copies are kept.

Signing in

• Sign in with a password of at least 8 characters, or with Google or Apple. An email address has to be confirmed before it can sign in, and repeated attempts to sign in are slowed down.
• Two-step sign-in, after your password: a code from an authenticator app, or one sent to your mobile by text or WhatsApp, free, with backup codes in case you lose your phone. You're emailed if it's turned off, or its mobile is set up or removed.
• Passkeys in the web app, so you can sign in with your fingerprint, face or device PIN instead of a password.
• Changing your password signs you out on your other devices.
• Drivers sign in without a password, with a link or a code sent to them.

Who in your business sees what

• Only your organisation sees its records: the people your admins invite, and the drivers they add. Nobody else on Tippa can see them.
• Admins run the account. Only an admin can invite people, change their roles, change the plan, export the organisation's data or delete it.
• Drivers see their own work: their rounds and collections, not the office's records.
• Weighbridge users are kept to the sites an admin gives them.
• Someone who leaves can be disabled. They're signed out everywhere at once and can't sign back in.
• Every change is recorded. Each record keeps who made it, who changed it and what each edit changed, and admins can read everything in the Activity Log.

Tippa's staff

• Our staff sign in to their own tools with Tippa's own Google accounts, kept apart from customers' accounts. Only staff we've authorised can.
• They look at your organisation's account and records only when they need to, to answer a support request or put a problem right, and each time one of them looks it's logged.
• When you ask them to change something for you, they check first that they're talking to your organisation. Each change they make is logged and shows in your Activity Log.

Payments

Paddle takes payments for Tippa, as the merchant of record. Your card details go to Paddle, and Tippa never sees or stores them.

Your data is yours

• Take a copy any time. An admin can export everything your organisation keeps in Tippa as a single file from Settings, and anyone can export their own data.
• Cancelling deletes nothing. Cancel your plan and you keep what you've paid for to the end of the month, then go back to the free plan, with your records kept. Office users over the free plan's allowance are disabled, not deleted, and you pick who stays.
• Deleting your organisation. An admin can delete it from Settings. The law asks for duty-of-care records, such as waste transfer records, to be kept for a time, so those are archived out of sight for that time and everything else is deleted straight away. The privacy policy says what's kept.
• Deleting your account. Delete your account gives the steps, even if you can't sign in.

Keeping working

• Tippa works with no signal, and sends what you recorded when you're back online.
• We're told automatically when something goes wrong in Tippa, so we can put it right.
• Our service status page shows whether Tippa is up.

Certification

We don't hold a security certification such as Cyber Essentials yet. This page says what we do instead, and we update it when that changes.

Reporting a security problem

If you think you've found a security weakness in Tippa or this website, email security@tip-pa.co.uk with what you found and how to see it. Please don't look at anyone else's data, or disrupt the service, while you check, and give us time to fix it before you tell anyone else. Our security.txt gives the same address.

For anything else about your personal data, email privacy@tip-pa.co.uk.