Security

Your stock, your customers and your money are on this system. This page says where that data lives, how it is protected, who can see it, and what happens if something goes wrong. It is written for the person at your dealership, or your accountant, who wants to check before you sign up.

Where your data lives

• The database is in the European Union (Paris), run by Supabase. Every table is locked so that only our own server can read or write it; nothing in the browser can reach it directly.
• Backups are taken every night, encrypted before they leave the database, and stored in a separate EU location (Cloudflare). We have tested restoring from them.
• Photos are stored with the database, in the same EU region.
• The application server that answers the app runs on Railway. It processes data as it passes through and stores nothing of yours itself.

How it is protected

• Encrypted in transit (TLS, the padlock in the browser) and at rest (AES-256 on disk and in backups).
• Every query is tied to your dealership. One dealership cannot see another's data, by design of the code and the database, not by convention.
• Passwords are hashed with bcrypt and never stored readable. A password that has appeared in a known data breach is refused at sign-up.
• Two-step sign-in on every account: a code by email, an authenticator app, or a passkey (Face ID, Touch ID, a security key). Repeated failed attempts lock the account for a short time.
• Sessions are short-lived and end everywhere the moment a password is changed. You can see every active sign-in, with its rough location, and end any of them.
• Connected services (Auto Trader, Xero and similar) are stored with their tokens encrypted; the keys to decrypt them are not in the database.
• The activity log cannot be edited or deleted, by anyone, including us.
• No PHP, no WordPress, no plugins. The app, the website and the dealer websites we host run on Node.js and React, kept up to date.

Who can see your data

You and the people you invite, with the roles you give them. Our own operator console shows platform-wide counts and the support tickets you send us; it does not open a dealership's stock, prices, customers or sales. If we ever need to look inside your account to fix a problem, we ask you first.

We do not sell data, do not use it for advertising, and do not train AI on it. The AI features (Piston, the advert writer) run on Anthropic's commercial service, whose terms forbid training on customer content.

Who we rely on

The companies that handle data on our behalf, each under a data processing agreement we hold:

• Supabase (European Union (Paris)): Database and file hosting — where dealership records and photos are stored.
• Railway (United States): Application hosting — runs the software itself.
• Vercel (Global content network): Website and app delivery.
• Resend (United States): Sending and receiving email — login codes, invoices, notifications and the lead inbox.
• Stripe (United States and European Union): Subscription billing — card details are given straight to Stripe and never reach Forecourt CRM.
• Anthropic (United States): The AI behind Piston (the in-app assistant), advert writing, reading receipts and logbooks, and first replies to support questions. This is under Anthropic's commercial terms, which do not permit training on customer data.
• Cloudflare (European Union): Encrypted nightly backups of the database and stored files.
• ipinfo (United States): Turns the internet address of each sign-in into a rough town or country, shown on your sessions screen so you can spot a sign-in that is not yours. Only the address is sent, nothing else.
• Microsoft (United Kingdom and European Union): Microsoft 365 business email and support correspondence.

The full list, including services that only apply once you switch them on, is in our Data Processing Agreement. Where data is handled outside the UK, it is covered by the UK International Data Transfer Addendum.

If something goes wrong

• Live service status, and every past incident, is on our status page.
• If a security breach affects your data we tell you without undue delay, and the ICO within 72 hours where the law requires it. We have a written plan for this.
• Each provider above has agreed to tell us of a breach on their side within 48 hours or without undue delay.

Your data is yours

• Export every car, customer and invoice as a spreadsheet from Settings, any time.
• Delete your account from Settings. Nobody can sign in from that moment; every row and file is erased 30 days later (the gap lets you undo a mistake).
• We keep only what the law makes us keep: our own billing records, for six years, as HMRC requires.

What we have not done yet

We are a new company and we would rather say so than pretend otherwise. We have not yet had an independent penetration test or a SOC 2 audit. Both are planned once the first dealers are settled. Our code is reviewed and tested automatically on every change, and the security design is documented in the open for anyone who asks.

Found a problem?

Tell us at hello@forecourtcrm.com. Our security.txt says what is in scope. We would much rather hear from you than not, and we will not pursue anyone who reports in good faith.

The company

Forecourt CRM Ltd, registered in England and Wales, company number 17512769, registered office 66 Paul Street, London, EC2A 4NA. ICO data protection register number ZC278280. The legal detail behind this page is in the Privacy Policy, the Terms of Service and the Data Processing Agreement.