Data protection
Sub-processors
Last updated: 1 October 2026
These companies process personal data on our behalf to run AssetAligned. We'll email account Owners at least 14 days before adding or replacing one.
| Sub-processor | What they do | Data they handle | Where |
|---|---|---|---|
| Supabase | Database, sign-in, account emails and file storage | Everything in your register, user accounts, uploaded files | London, UK. Account emails may be sent from outside the UK |
| Vercel | Hosts the website and app | Data passing between your browser and the database | London, UK |
| Cloudflare | Security check on sign-in and sign-up | IP address and browser details of people signing in | Cloudflare's global network |
| IONOS | Our support mailbox | Anything you email to support@assetaligned.co.uk | TODO: [IONOS REGION] |
Data Processing Agreement
Last updated: 1 October 2026
This agreement is between AssetAligned ("we", the processor) and the organisation using AssetAligned ("you", the controller). It forms part of our Terms and applies whenever we process personal data for you. It's written to meet Article 28 of the UK GDPR.
1. Roles
You decide why and how personal data in your register is used. We process it only to provide AssetAligned to you. Annex 1 describes the processing.
2. Your instructions
We process personal data only on your documented instructions. Your instructions are these terms and the way you use and configure AssetAligned. If we're legally required to process data in another way, we'll tell you first unless the law forbids it. If we think an instruction breaks data protection law, we'll tell you.
3. Confidentiality
Everyone we allow to access your personal data is bound by a duty of confidentiality.
4. Security
We keep appropriate technical and organisational measures in place to protect your personal data. Annex 2 lists them. We may improve them over time, but we won't reduce the overall level of protection.
5. Sub-processors
You agree to the sub-processors listed above. We'll email account Owners at least 14 days before adding or replacing one. If you object on reasonable data protection grounds, tell us. If we can't resolve it, you can close your account before the change takes effect.
Each sub-processor is bound by data protection terms that give at least the same protection as this agreement. We remain responsible to you for their work.
6. Helping with data rights requests
AssetAligned lets you find, correct, export and delete records yourself. If we receive a request directly from someone in your register, we'll pass it to you without answering it ourselves. We'll give you reasonable help with requests you can't handle in the app.
7. Personal data breaches
If we become aware of a breach affecting your personal data, we'll tell you without undue delay, and within 48 hours. We'll give you the information you need to meet your own duties, including what happened, the data and people likely affected, and what we're doing about it.
8. Other help
We'll give you reasonable help with data protection impact assessments and with consulting the ICO, where they relate to AssetAligned.
9. Transfers outside the UK
Your register and files are stored in London. We'll only transfer personal data outside the UK where UK law allows it, such as to a country with an adequacy decision or under the International Data Transfer Agreement or the UK Addendum.
10. Deleting your data
When you close your account, we delete your personal data within 30 days. Backups are overwritten within a further 30 days. You can export your data before closing. We only keep data longer where the law requires it.
11. Showing that we comply
We'll give you the information you reasonably need to show that we meet this agreement. During the beta, we'll answer a reasonable written security questionnaire once a year, or after a breach affecting your data.
12. Liability and conflicts
The liability terms in our Terms apply to this agreement. If this agreement and the Terms disagree about personal data, this agreement wins.
Annex 1: Details of the processing
| Subject | Running AssetAligned, an asset register for your organisation |
|---|---|
| Purpose | Storing, displaying, checking and reporting on your assets and who is responsible for them |
| What we do with the data | Store, organise, display, search, export, back up and delete it |
| People the data is about | Your staff, contractors and other people you record as holding or responsible for assets, and your users of AssetAligned |
| Types of personal data | Names, work email addresses, departments, locations, which assets people hold, stock check answers and notes, files you upload (such as invoices or photos), and records of who did what in the app |
| Special category data | None needed. Please don't upload health, criminal or other special category data |
| How long | For as long as your account is open, then deleted as set out in section 10 |
Annex 2: Security measures
Where data lives
- The database, files and app run in London, UK.
- Data is encrypted in transit between your browser and AssetAligned.
Keeping organisations apart
- Every organisation's data is kept separate by rules in the database itself, not only by the app.
- These rules are tested automatically, including attempts by one organisation to reach another's data.
Signing in
- Multi-factor authentication is on by default for Owners, Admins and Finance users. Only an Owner can turn it off.
- Sensitive actions ask for a fresh multi-factor check.
- Sessions end after at most 12 hours.
- A security check blocks automated sign-up and sign-in attempts.
Access within your organisation
- Each person sees and does only what their role allows. Financial values are hidden from roles that don't need them.
- Disposals and imports need a second person, and any single-person exception is flagged for review.
Files
- Uploaded files are stored privately. Each download uses a link that works for 2 minutes, created only for someone allowed to see the file.
Records and recovery
- Every important action is recorded with who did it and when. Users can't edit or delete these records.
- Backups are kept encrypted, and restoring from them has been tested.