Security
How OneGoodArea protects your data and ours: the technical and organisational measures in place today, the sub-processors we rely on, and what is on our roadmap. It sits alongside our Privacy Policy and Data Policy.
01 · Overview
Our approach. OneGoodArea is UK area-intelligence infrastructure used by property and risk teams. We are a UK sole trader and we process personal data in line with the UK GDPR and the Data Protection Act 2018.
We are an early-stage company and are not yet SOC 2 or ISO 27001 certified (both are on our roadmap). In the meantime, this page documents the controls we have in place today, and we are happy to sign a data processing agreement (DPA) and complete your security questionnaire. For the underlying detail, see our Privacy Policy and Data Policy.
02 · Data we hold
Area data, not your customers' data. Our core product returns area-level intelligence computed from public datasets (crime, deprivation, prices, schools, flood risk, and more), queried using only a postcode or area code. We do not receive or store your customers' personal data to produce it.
The personal data we do hold is account and usage data: your name, email, a hashed password, API keys, and a record of the API requests you make. This is described in full in our Privacy Policy and Data Policy.
03 · Encryption
In transit. All traffic is served over HTTPS/TLS. Our web application sends HTTP Strict Transport Security (HSTS) so browsers only ever connect to it over HTTPS.
Application data is stored in Neon Postgres, which encrypts data at rest. Passwords and API keys are additionally hashed (see below), so they are never stored in a readable form.
04 · Authentication + access
Passwords. User passwords are hashed with PBKDF2-SHA256 using 600,000 iterations and a unique per-password salt, and compared in constant time. We never store passwords in plaintext.
Authenticated sessions use short-lived signed tokens. Entitlements are always read live from the database and never trusted from the token.
Organisations have owner, admin, and member roles. Membership and role are checked on every organisation action, and the last owner of an organisation cannot be removed.
API keys are shown once at creation and stored only as a SHA-256 hash; the raw key is never persisted. Keys are scoped to your account and organisation, and can be restricted to an IP allowlist on request.
05 · Application security
Rate limiting. API requests are rate limited. The standard limit is 30 requests per minute per API key on a 60-second sliding window.
Outbound webhooks are signed with HMAC-SHA256 so you can verify every payload, support secret rotation, and only deliver to HTTPS destinations.
Requests are validated at the API boundary, and all database access uses parameterised queries.
The web application sends a Content-Security-Policy and standard security headers, including X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
06 · Secrets + infrastructure
Secrets. Credentials and secrets are injected through environment configuration and are never committed to source control. Logs redact credentials before they are written.
The web application runs on Vercel, the API on Render, and the database on Neon. Each is a reputable provider that maintains its own security programme.
07 · Sub-processors
We rely on the following sub-processors, each operating under a data processing agreement. Our core infrastructure providers maintain their own security certifications.
For the specific data shared with each processor, see the third-party services section of our Privacy Policy.
Payments and subscription management
Web application hosting and edge delivery
API service hosting
PostgreSQL database hosting
Natural-language query planning (no personal data sent)
Transactional email delivery
Sign-in with Google (optional)
08 · Handling + retention
Retention. Account data is kept while your account is active and erased within 30 days of a deletion request, except where the law requires longer (for example, financial records for up to 7 years). Model-training logs, where you have not opted out, roll off automatically after 365 days.
We do not sell your personal data, and we do not use it for advertising or profiling. Full detail is in our Data Policy.
You can opt out of your API queries being used to improve our models, per API key, at any time.
09 · Compliance + roadmap
Today. We process personal data in line with the UK GDPR and the Data Protection Act 2018. We will sign a DPA and complete your security questionnaire on request. Where sub-processors handle data outside the UK, transfers are covered by Standard Contractual Clauses or equivalent safeguards.
We are not currently SOC 2 or ISO 27001 certified. Formal certification (SOC 2 Type II and ISO 27001), a self-serve IP-allowlist interface, and expanded organisation-level audit logs are on our roadmap as we grow into larger regulated deployments.
10 · Reporting a vulnerability
If you believe you have found a security vulnerability, email operation@onegoodarea.co.uk with the subject "Security". We investigate every report and aim to acknowledge within two business days. Please give us reasonable time to remediate before any public disclosure.
11 · Contact
For any security questions, contact us at operation@onegoodarea.co.uk.
See also our Privacy Policy, Terms of Service, and Data Policy.
We read everything that lands at operation@onegoodarea.co.uk and we usually reply within one business day.