Security
You’re trusting us with people’s bank details. Here’s how we look after them.
Bank details are encrypted
Sort codes and account numbers are encrypted in the database with AES-256-GCM. Lists only show the last 4 digits; the full numbers appear only to the office and the accountant, when paying.
Bank changes are checked
If a driver changes bank details that were already checked, their invoices are held and keep paying into the old account until the office has confirmed by phone.
Passwords and PINs are never stored
Only bcrypt hashes are kept. After 5 wrong attempts, logins lock for 15 minutes.
Every company is kept apart
Every query is limited to your company, and automated tests check that one company can’t see or change another’s data.
People see only their part
Drivers and PAs see only their own invoices. Your accountant sees only who to pay. The office sees everything.
Stored in Ireland
Your data sits in a database in Ireland that isn’t reachable from the internet, with row level security on every table.
Nothing quietly disappears
Invoices are voided, never deleted, and every action is recorded with who did it and when.
Links that expire
Invite and details links work once, expire, and are stored only as fingerprints that can’t be turned back into the link.
HTTPS everywhere
Every page and login uses an encrypted connection, and login cookies can’t be read by scripts.
Your data, whenever you want it
Download everything as an Excel file at any time.
More detail is in our privacy policy and data processing agreement. Found a security problem? Please tell us at hello@schoolrunsheet.co.uk and we’ll respond quickly.