Trust
What we do to keep your agency's records safe, where they live, who else can see them, and what we have not done. No badges we have not earned.
Last updated:
You are handing us the names of children, the addresses of the families you work for, and the documents your staff would least like leaked. This page says what happens to all of it. It is deliberately specific: anything written here can be checked, and the things we have not done are at the bottom rather than missing.
Every record carries the agency it belongs to, and the filter is applied by the framework on every query rather than remembered by whoever wrote the screen. It has its own test suite, and a separate command audits for any sign-in that has drifted across agencies.
A deletion request destroys the attachments, the free text, the messages and the login, keeping only an anonymised row where the law requires the financial record kept. A soft delete is not erasure and we do not count it as one.
The whole account exports as one structured file: people, bookings, invoices, documents and settings. It is a button rather than a support ticket, and it is yours whether or not you are still a customer.
Passwords are at least twelve characters and checked against known breach lists. Two-factor is open to every role. Changing an email or password emails the previous address as well as the new one, so an account cannot be moved quietly, and it signs every other session out.
No analytics, no session recording and no advertising script is in the page until you opt in, and session recording is never offered once you are signed in. A test fails the build if any off-origin script appears in a page we serve.
Typefaces come from our own servers rather than a font CDN, so reading a page here does not hand your IP address to a third party. That is a data-protection decision rather than a speed one.
A visit photo carries its own answer to whether it may be used elsewhere, and “nobody asked” is stored as a different state from “no”. It can never be read as permission.
Every connection is HTTPS. The database is backed up nightly and kept for fourteen days. Files that are not meant to be public are served through a check that the person asking is entitled to them, rather than by being hard to guess.
Oracle Cloud Infrastructure, Frankfurt, Germany. Your agency's records, the documents you upload and the database behind them all sit inside the EU. Backups stay on the same machine, in the same region.
Until 17 October 2026 this ran from Oracle's Hyderabad region, and this page said so. It moved for two reasons, and data residency was the more important of them: India has no UK or EU adequacy decision, so the transfer needed standard contractual clauses behind it. It does not need them now. The second reason was speed, and a page that took about two seconds from Europe now takes under half of one.
If your own compliance position turns on any of this, ask us. It is a reasonable thing to want in writing.
The full list of companies we send data to is on the privacy policy, named individually with what each one receives. It is short on purpose. We are the processor for everything your agency stores about its staff, its clients and the people they care for; your agency is the controller, which means requests about that data come to you and the software gives you the tools to answer them.
The data processing agreement is published, not sent on request: a document you have to ask for is one people assume says something they would not like. It names every sub-processor and lists the security measures that actually exist. If your own adviser wants changes, we would rather read them than argue.
Every competitor's site has a row of compliance badges. Here is ours, honestly.
Email hello@rostavo.com with enough detail to reproduce it. We will reply, we will tell you when it is fixed, and we will not threaten you for having looked. Everything previously reported to us has been fixed.
Please do not run automated scanning against the production site, and do not use another agency's data to prove a point. If you need an account to test with, ask and we will make you one.
If your agency has a compliance checklist, send it. We would rather answer it than have you guess.