Security and data protection
Electoral registers, voting intentions and supporter records are some of the most sensitive data under GDPR. Cadrify keeps that data in the EEA, encrypts it in storage and in transit and keeps each organisation's records apart in the database itself.
Hosted in the EEA
Your register and door-knock data is stored in a PostgreSQL database in Frankfurt, Germany, on infrastructure run by Render. Data does not leave the European Economic Area at rest.
What you can rely on
- Register and door-knock data stored in Frankfurt, within the EEA
- Data does not leave the EEA at rest
- Email runs through a specialist provider that never receives register data
Privacy by design
For British parties, unions and membership bodies, where records sit and who can reach them matters. Cadrify follows data minimisation and purpose limitation. Every record belongs to one organisation, and the database itself enforces that boundary.
What you can rely on
- EEA hosting for register and supporter records
- GDPR-aligned processing with data minimisation and purpose limitation
- Breach notification within 72 hours where required by UK GDPR
- A Data Processing Agreement available for your due diligence
Encryption by default
Every connection to Cadrify is encrypted. Stored data and backups are encrypted at rest by the underlying infrastructure. Passwords are never stored in a readable form.
What you can rely on
- TLS (HTTPS) on every connection, with no unencrypted HTTP allowed
- Encryption at rest for database records and backups
- Passwords hashed with scrypt, 12 characters minimum, common choices rejected
- Login rate limiting and account lockout after repeated failed attempts
People see only what their job needs
Each person gets the functionality and data their role calls for, and nothing more. Roles sit on a branch of your organisation and are resolved down the tree.
What you can rely on
- Limit each person to the functionality their job needs
- Activists cannot browse the register, only the round assigned to them
- Door-knock rounds expire, so access ends once the task is done
- An audit log across the app, exportable, so you can see who did what and when
Technical details
A short summary for security questionnaires. For the full policy, audit log requests and the Data Processing Agreement, see the links below or email security@cadrify.org.
EEAEEAZC158949.Cadrify is not certified as an organisation against ISO 27001 or SOC 2. Single sign-on through your organisation's own identity provider (OIDC) is built and available on request. Multi-factor authentication and external penetration testing are on our published roadmap and not built yet. The security whitepaper sets out current controls and what is planned.
Common questions
Where is my data hosted?
Your register and door-knock data is stored in a PostgreSQL database in Frankfurt, Germany, on infrastructure run by Render. Data does not leave the European Economic Area at rest.
Is my data encrypted?
Yes. Every connection uses TLS (HTTPS), with no unencrypted HTTP allowed. Stored data and backups are encrypted at rest by the underlying infrastructure. Passwords are never stored in a readable form.
Can other organisations see my data?
No. Every record carries its organisation and every query is scoped to it. Tenant tables also carry a PostgreSQL row-level security policy, so the database itself withholds another organisation's rows. Within your organisation, each person sees only the functionality and data their role calls for.
Is Cadrify ISO 27001 or SOC 2 certified?
Cadrify is not certified as an organisation against ISO 27001 or SOC 2. Our infrastructure providers maintain their own independent certifications. Single sign-on (OIDC) is built and available on request. Multi-factor authentication and external penetration testing are on our published roadmap and not built yet.
Do you offer a Data Processing Agreement?
Yes. A Data Processing Agreement is available for your due diligence. You can read it online, or request it along with our security policy and whitepaper from security@cadrify.org.
Questions about security?
Read the full policy and whitepaper, or book a demo to go through your due diligence.