Security and your data

We never connect to your systems

ReadyCert doesn’t scan your network, install anything or sign in to your accounts. You describe your own setup in plain words — the devices you use, the cloud services you sign in to, how you work — exactly as you will in the official self-assessment. We store those descriptions. We never ask for your passwords, admin access or keys to Microsoft 365, Google Workspace or anything else.

What we store

• Your account — your email address, plus your name and profile basics if you choose to sign in with Google.
• Your business details and answers — your business name and size, your descriptions of your setup, your readiness-check answers, the gaps it finds and the documents drafted from them.
• Your plan — whether you subscribe. Card details are taken on Stripe’s own checkout page and stored by Stripe; they never reach ReadyCert.

Where it lives

Your account and business data are stored in the UK/EU, in our database provider Supabase’s London region. Vercel hosts the website and the app, Resend sends our emails and Stripe handles payments. The full list of providers, and what each one does, is in the privacy policy.

How it’s protected

• Every table holding your data has row-level security, so one business can never read another’s — the database enforces it, not just the app.
• Data is encrypted in transit and at rest.
• Passwords are handled by our authentication provider and stored only as a secure hash; we never see them. We ask for at least 12 characters, and every new account confirms its email address.
• Access is least-privilege: the keys that can change payments or administer the database stay on our servers and never reach your browser.

What we don’t do

We don’t sell your data or use it for advertising. We don’t use advertising or third-party tracking cookies, and our analytics are cookieless, with no session recording.

You’re in control

You can delete your business and everything in it yourself, from the billing page in the app, and that also deletes your login. You can ask us for a copy of your data, or ask us to delete it, at any time.

Report a security problem

If you think you’ve found a security issue, email support@readycert.co.uk. We read every report and will reply. No system is perfectly secure, but we take this seriously — keeping small businesses safe is the whole point of the product. See also how we keep ReadyCert accurate.