Your data, looked after properly.

Your data belongs to you

Everything you enter — your sites, HACCP plans, records, controlled documents and users — remains your property at all times. Under data-protection law you are the data controller and HACCPdb is the data processor: we only process your data to provide the service to you, on your instructions.

• We never sell or share your data with third parties.
• We do not use it for advertising or marketing.
• We do not use it to train any AI or models.
• We access it only where needed to support you.

No lock-in — take it with you

• Export any time: records throughout the system export to CSV, and you can download a complete, encrypted backup of your entire database whenever you wish.
• Leave freely: if you ever stop using HACCPdb you keep a full copy of your data, and we delete our copy on request.

How your data is protected

• Encrypted in transit: all traffic uses HTTPS/TLS.
• Encrypted backups: compressed and encrypted with AES-256-GCM, using a password only you hold.
• Role-based access: administrator, manager, staff and auditor roles limit what each user can see.
• Protected passwords: stored only as one-way bcrypt hashes — unreadable, even by us.
• Automatic sign-out and a login audit trail of every sign-in attempt.
• Isolation: each customer runs in their own dedicated, containerised instance — your data is never co-mingled with another business's.

Where your data lives

Your data is hosted within the EU and does not leave the UK/EU region in the normal course of providing the service.

Retention & deletion

We retain your data for as long as you are a customer. On account closure — or on request — your data is deleted, and a final export can be provided beforehand so nothing is lost.