Data protection and the audit trail
Cadrify holds the electoral register and doorstep data the way British data law expects. The audit trail, subject access export, erasure process and processing record are part of the product.
A campaign holds the personal data of tens of thousands of people and is answerable for it. Cadrify handles that in the software itself. Every organisation's data is isolated at the database level, every change is written to an audit log, and the tools a data protection officer needs are on the compliance page.
Access follows your branch hierarchy. A role granted at a branch applies to that branch and everything below it, and an organiser sees the wards their branch owns. Nothing is configured per user and per ward.
When a resident asks what you hold about them, the answer is one export. When they ask you to erase it, the request is recorded, reviewed and carried out in a way that leaves a record of the request itself and nothing else.
How it works
Every change is written to the audit log
Register imports, edits to an electorElector nounA person entitled to vote who appears on the electoral register at their address.In Cadrify Every elector is a single ongoing record in Cadrify. Door-knock history, score, voting history and contact details all attach to that one person across every register import and every campaign that uses it., rounds created and assigned, roles granted, settings changed, features switched on. Each is one row in the audit log with who did it, when and a one-line summary. The log covers more than 120 distinct actions across the product.
Filter by action or by the kind of record, or download the whole log as CSV, which adds the address each action came from. Downloading the log is itself logged.
Exports are recorded
Every CSV, spreadsheet and PDF that leaves the system is recorded with the person or API key that took it, the kind of export and the number of rows. The compliance page lists the most recent ones, so a data protection officer can see what has left and who took it.
Subject access in one export
Find the elector by name or register number, including people who have since come off the register, and export everything held about them as one structured file: their register entry, address, voting history, every doorstep log, every change the council has made and any published donation the organisation has linked to them.
The export is read-only and is itself written to the audit log.
Erasure with a record
An erasure request is logged against the elector or contact with a reason and the day it arrived, and sits as pending until an admin approves or rejects it. Approval replaces the name and date of birth, deletes their doorstep logs, change history and donation links, and strips the details from audit entries about them while keeping who did what and when. A later register upload keeps the entry blank. The record of the request itself is kept, so you can show what was done and when.
The processing record is built from the code
The Article 30 record of processing activitiesROPA nounA record of processing activities, the written inventory of what personal data an organisation processes, why, on what lawful basis and how long it is kept, required by UK GDPR.In Cadrify Cadrify generates the platform side of your ROPA from the code itself, so it describes what the system does rather than what someone remembered to write down.Full definition → is built from a register kept in the codebase, one entry per activity, 16 in all, each with its purpose, data categories, lawful basisLawful basis nounOne of the six grounds in UK GDPR that must apply before any personal data is processed at all. Campaigns normally rely on legitimate interests or public task.In Cadrify A lawful basis on its own is not enough for the political opinions Cadrify holds, which need an Article 9 condition on top.Full definition →, special categorySpecial category data nounPersonal data UK GDPR protects more strictly, including political opinions, health and ethnic origin. Support scores and voting intentions recorded at the door are political opinions, so a campaign database holds this by design.In Cadrify Cadrify isolates every organisation's records and logs access and exports against them.Full definition → condition, retention, security measures and the parts of the system that implement it.
Open it in the app or download it as Markdown to attach to your own records.
Access follows the branch tree
Users hold a role on a branch: activist, organiser, admin or data protection officer. Admin is inherited by every branch below the one it was granted on. An organiser works within the wards their branch owns, and a data protection officer has read-only access to the compliance area for the whole organisation and nothing else.
In practice
Appointing a data protection officer
Add the person as a user and give them the data protection officer role on any branch. They can open the compliance area for the whole organisation, read the audit log, log and answer subject access requests and raise erasure requests. They cannot approve an erasure, or see or edit voter data.
A resident writes in asking what you hold
Log the request on the compliance page the day it arrives, and its due date shows until you answer it. Download the file from the request. It carries every record keyed to that person, including doorstep logs and the council's change history. The export is logged, so the response and its date are on record.
A request to be forgotten
Log the erasure request with the reason and the day it arrived. An admin reviews it under Data rights and approves or rejects it. Approval anonymises the record and deletes the notes and history in one transaction, and the request stays on file as evidence.
An organiser leaves the campaign
Remove their role from the branch and their access ends with it. Everything they did while they had access stays in the audit log under their name.
Preparing for an audit or a complaint
Download the audit log as CSV and the processing record as Markdown. Together they show what the system does with personal data, on what basis, and what your people did with it.
FAQ
Is our data separate from other organisations on the platform?
Yes. Over 100 tables carry a row level security policy in PostgreSQL, and each request sets the organisation it is acting for before it runs a query. Data from one organisation is not returned to another even if a query asks for it.
What is logged?
Imports, elector edits, doorstep logs, rounds and assignments, poster and leaflet work, roles granted and removed, feature and settings changes, API keys and every export. Each entry records the actor, the time, the address it came from and a summary.
Who can read the audit log?
Organisation admins and anyone holding the data protection officer role. A data protection officer can log requests and raise erasures there but changes no records. Erasure approvals happen in the admin area and need the admin role.
What does a subject access export contain?
The elector's register entry, their address, voting history, every doorstep log, the change log from register imports, and any published donation link or objection recorded against them. It is a structured JSON file named for the elector.
What happens when an erasure is approved?
Name and date of birth are replaced, the anonymisation is timestamped, and their doorstep logs and change history are deleted. Audit entries about them keep the action, time and who did it, with the details removed. Audit entries about the erasure request itself are kept whole. A later register upload recognises them without storing their name and keeps the entry blank. For a volunteer contact, name, email, phone and date of birth are cleared.
Do public sign-up forms collect consent?
Every public form, petition, event and open letter carries an opt-in tick to be contacted about future campaigns. A volunteer contact is only created when it is ticked. A poster request does not need the tick, since delivering a poster someone asked for is not marketing.
Does this cost extra?
No. The audit log, subject access export, erasure process and processing record are part of every plan. Nothing here is metered.
What this means for your campaign
The questions a regulator or a resident might ask have answers you can produce from the app: what you hold, who has looked at it, what has left the system and on what basis you process it. None of it depends on someone having kept a spreadsheet.
Organisers get on with the campaign. The data protection officer gets a page of their own, with read-only access to the compliance area for the whole organisation.
See Cadrify in action
Book a demo and we will walk you through it on a real ward.
- Electoral registerImport the roll, match records across imports and track every change.
- Marked registerScanned marked registers read into turnout on each elector's record.
- Filters & targetingDrag-and-drop filters over the register, used by rounds, drops and dashboards.
- Door-knockingRounds from the road network, recorded at the door on any phone.
- Leaflet roundsDrops on the ward's rounds, handed out by link, sheet or QR code.
- PhonebankingCall lists from your contacts, a script and a one-at-a-time call screen.
- GOTVTelling at the station, knock-up rounds and turnout live through the day.
- VerificationSample the count box by box and read a live projection with a margin of error.
- Events & sign-upsSign-up pages, QR check-in and consenting attendees saved as contacts.
- Supporter actionsPetitions, open letters and forms on a public link, with consenting signers saved as contacts.
- Fundraising betaDonation pages on your own Stripe account, recorded for the PPERA return.
- Posters & boardsPoster and board requests on a map, bundled into rounds for volunteers.
- Election paperwork betaPrint-ready nomination packs, each candidate entered once.
- Activists & CRMMember, supporter and volunteer records, matched to the register.
- Gamify your campaigningLive leaderboards, a level ring and a trophy case for every volunteer.