Security & Compliance

Built GDPR-first, for UK MSPs

All your client data is stored in the UK. We treat security as a product feature — not an afterthought.

🇬🇧

UK data residency

All customer data is hosted in London (DigitalOcean LON1); transactional email is sent from AWS London. Certificate-transparency look-ups use the providers listed in our sub-processor register. Error monitoring is self-hosted (GlitchTip) in DigitalOcean LON1.

🔒

Encryption at rest

PSA credentials and TOTP secrets are encrypted with AES-256-GCM before storage. TLS 1.2+ enforced for all connections.

🏗

Tenant isolation

Every database table has an msp_id column. PostgreSQL Row-Level Security (RLS) is enforced at the database level — not just in application code. A compromised API key cannot read another tenant's data.

📋

Full audit log

Every action — sign-in, config change, certificate renewal, team membership change — is recorded with actor, timestamp, IP address, and entity. Owners and admins can export audit logs as CSV.

🔑

Two-factor authentication

TOTP-based 2FA is available for all accounts and can be enforced workspace-wide. TOTP secrets are stored AES-256-GCM encrypted, never in plain text.

💳

PCI-DSS payments

Tidehawk never stores card numbers. All payments are processed by Stripe (PCI-DSS Level 1 certified). Stripe handles tokenisation, 3D Secure, and UK/EU VAT compliance.

Infrastructure at a glance

Compute & hostingDigitalOcean App Platform, LON1

DatabasePostgreSQL 16 with RLS, LON1

Encryption at restAES-256-GCM (application layer)

Encryption in transitTLS 1.2+ everywhere

Email deliveryAWS SES eu-west-2 (London)

Error monitoringSelf-hosted GlitchTip (DigitalOcean LON1)

PaymentsStripe (PCI-DSS Level 1)

DNSCloudflare DNS-only — no proxy, no PII traversal

AuthenticationAuth.js v5 with TOTP 2FA

CI/CDGitHub Actions — lint, typecheck, unit, integration, RLS suite

GDPR compliance

Tidehawk acts as a data processor for the personal data you store (client contacts, team member details). We provide a Data Processing Agreement, support the right to erasure, and offer a full data export for all workspaces.

DPA available

Signed Data Processing Agreement on request

Right to erasure

Account deletion with 30-day retention window

Data export

Full JSON export of all workspace data on demand

Security FAQs

Do you have a Data Processing Agreement (DPA)?▼

Yes. A GDPR-compliant DPA is available to all subscribers on request. Email hello@tidehawk.co and we will send you a signed copy within one business day.

Is Tidehawk ISO 27001 certified?▼

Not yet. We follow ISO 27001-aligned controls and are building toward certification. If this is a hard requirement, email us — we can share our security policy documentation.

How is PSA credential data protected?▼

PSA credentials (OAuth tokens, API keys) are encrypted with AES-256-GCM using a key stored separately from the database. Even with full database access, credentials cannot be read without the encryption key.

What happens to data on cancellation?▼

Your data is retained for 30 days after subscription cancellation, then permanently deleted. You can request immediate deletion by contacting support.

How do I report a security vulnerability?▼

Email security@tidehawk.co with a description of the issue. We aim to acknowledge within 24 hours and will work with you on coordinated disclosure.

Security questions?

We are happy to share our security policy documentation and answer due-diligence questions.

security@tidehawk.co Start free trial