Skip to content
TradesPlace

Security

17 September 2026

We look after websites, phone numbers and customer enquiries for small businesses that mostly do not have anyone to do this for them. This page says what we actually do about security, in enough detail to be checkable.

Your data at rest and in transit

The application and its database run in Amsterdam, Netherlands (EU). Connections to the database are TLS-encrypted and the application refuses to start against an unencrypted one. Public traffic is served over HTTPS with HSTS.

The telephone number and email address on an enquiry get a second layer on top of the provider's own disk encryption: they are encrypted in the application with AES-256-GCM before they are written, under a key the database server never holds. Those two columns are the ones a stolen dump would be worth something for — a clean list of members of the public and how to reach them — so a database read alone does not produce one. Alongside each is a keyed digest of the same value, which lets an enquiry be matched to an earlier one without anything being decrypted.

Backups are taken daily, encrypted before they leave the machine with AES-256-GCM under a key derived by scrypt, and stored in object storage in the European Union under credentials scoped to that bucket alone. A watchdog checks every day that a fresh backup actually arrived, because an untested backup is a hope rather than a plan.

Accounts and access

Administrative access requires a password and a second factor. Session tokens are 32 bytes of randomness and only a SHA-256 hash of each one is stored, so a copy of our database does not let anyone log in as you. The same pattern covers client sessions, magic links and onboarding links.

Client sign-in is passwordless and deliberately gives nothing away: the response is the same whether or not an address is registered. Links are single-use and short-lived.

Every administrative route is behind a central gate, and a test walks every one of them without a session and asserts it is refused — so a route that forgets the check fails the build rather than shipping.

In the client portal, which business you are looking at comes from your session, never from a parameter in the request. You cannot change a number in a URL and see someone else's leads.

The rest of the estate

  • Every incoming webhook signature is verified — payments, email, post, telephony and domains — and the routes that are intentionally unsigned are inventoried by a test.
  • Database access goes through a query builder throughout; there is no string-built SQL.
  • File serving is allowlisted by pattern with directory traversal rejected and containment re-checked.
  • A site-wide Content Security Policy, `frame-ancestors 'none'`, `nosniff`, a referrer policy and a deny-by-default permissions policy are set on every response.
  • Authentication routes are rate-limited, as are the mutating parts of the API.
  • Error reports carry tags only — no request bodies, no headers, no cookies — and are sent to a monitoring service hosted in the European Union.
  • Containers run as a non-root user.

Sending and deleting

Outbound email, SMS, voice, WhatsApp and postal sending each have a kill switch that stops that channel immediately without a deploy.

Retention is enforced by scheduled jobs rather than intention. Call audio, transcripts, audit logs and assistant history each have a horizon, and when a client leaves, what we hold for them is exported and then purged on a fixed schedule. The periods are published on our Privacy Policy .

If TradesPlace stops

The honest risk with a supplier this size is not a data breach. It is that we are not here next year and your site goes down with us. So the plan agreement says what happens, as a commitment rather than a reassurance, and you can read it before you buy.

  • If we choose to stop, you get 90 days notice, a refund of anything you have paid for service you have not had, your site and your data in a form any other host can run, your domain moved to a registrar you choose, your tracked number ported with the code handed over unprompted, and 90 days of free hosting after the plan ends so nothing goes dark while you move. You do not have to ask for any of it. We also stop selling from the day we decide, not the day we announce.
  • If we cannot act at all, a named continuity deputy holds sealed emergency access and written instructions, triggered by us going unreachable. They keep your site, domain and number running, write to every client, hand back your data free, and refund what was prepaid.
  • If the business is sold, the agreement transfers with it unchanged and you are told before your data moves. If you would rather not continue with the buyer, you can leave without penalty or take the handback instead.

You own your domain, your site and your reviews from the first payment, and that ownership does not depend on us still existing. The detail is in clauses 15, 17, 18 and 21 of the plan agreement .

Reporting something

If you believe you have found a security problem, email privacy@tradesplace.co.uk and say what you found and how to reproduce it. We would rather hear it from you than from someone else. We will not pursue anyone who reports a genuine issue in good faith and does not access or alter data beyond what is needed to demonstrate it.

What we do not claim

We are a small company. We do not hold ISO 27001 or SOC 2, and we do not have a dedicated security team. What we have is a codebase that is reviewed for this, tests that enforce the parts that can be enforced, and the practices above.