How we look after
your data.

01What this covers

The client workspaces Drewframe provides: a customer relationship and project tool, each at its own address, branded as the client's own.

You, the client, are the controller of what goes into your workspace: your customers and contacts, deals, projects and notes, and your team's accounts. Drewframe is your processor. We host and secure the workspace and act only on your instructions, under a written data processing agreement signed before any data goes in. We do not use your data for our own purposes, and we never sell it.

People using a workspace can read its privacy notice at /privacy on the workspace's own address. This website's own privacy notice is here.

02Where data lives

Workspace data and user accounts are stored in London, in the United Kingdom, and encrypted at rest by the hosting provider. Every connection is encrypted in transit, and browsers are told to use nothing but HTTPS.

Some providers are based in the United States or run global networks, as listed under sub-processors. Where data is processed outside the UK, the transfer relies on safeguards UK law recognises: the UK extension to the EU–US Data Privacy Framework, or the International Data Transfer Addendum to the standard contractual clauses.

03Keeping clients apart

Every client has a separate workspace, and the separation is enforced by the database itself, not only by the application. Each request names one workspace. The database returns rows only from that workspace, and only to someone who belongs to it. A request that names no workspace gets nothing back.

So a fault in a page cannot show one client's records to another: the database would refuse the query. Automated tests check this against the live database whenever the data structure changes.

04Sign-in and access

Invitation only. Nobody can sign up for a workspace. Accounts are created when a workspace owner or admin invites someone.

Roles. Owners and admins manage the team, branding, pipeline and board structure, and permanent deletion. Members work with the records.

Passwords are at least 12 characters and stored only as secure hashes. Sign-in and authenticator attempts are rate limited per network address and per account. Password reset links work once and expire within the hour, and a reset signs the account out everywhere else.

No tracking. Workspaces set only the cookies needed to keep you signed in, and load no third-party scripts, analytics or advertising.

05Support access

Drewframe staff cannot see inside a workspace by default. Support access is granted to a named person for one workspace at a time, and it only works after they pass an authenticator-app check.

Every grant is recorded in a permanent audit log, and appears in your own Members list, labelled as provider support, so you can always see who has access. Suspending a workspace cuts off every kind of access immediately.

The tools we use to set up and manage workspaces require an authenticator on every sign-in. Actions that hand over or destroy data need a fresh code on top.

06Encryption and backups

The database is backed up every night. Each backup is encrypted before it is stored, with a key kept outside the systems that hold the backups, and is kept for 30 days before it is removed automatically.

07Deleting and returning data

Erasure requests

If one of your customers asks to be forgotten, an owner or admin can delete that customer permanently, along with their contacts, deals, projects, tasks and every note about them.

Housekeeping

Invitations are removed automatically 30 days after they are accepted or expire.

When you leave

You can have a complete export of your workspace in a standard, machine-readable format. We then delete the workspace, and any accounts that belonged only to it, and confirm in writing.

Backups

Deleted data is gone from the encrypted backups within 30 days.

08Sub-processors

These providers help run the workspaces. Each is bound by a data processing agreement. Clients are told at least 30 days before this list changes, and can object.

Supabase

PurposeDatabase and user sign-in

DataWorkspace records and user accounts

LocationStored in London, UK

Cloudflare

PurposeRuns the application, network security, rate limiting

DataRequests as they pass through; IP addresses; short-lived logs

LocationGlobal network, nearest location to each user; nothing stored at rest

Resend

PurposeInvitation and password reset emails

DataRecipient name and email address, email content

LocationSent from Ireland; company based in the US

GitHub

PurposeStores nightly backups

DataEncrypted backup files only. GitHub cannot read them.

LocationUnited States

No analytics, advertising or error-tracking service receives workspace data.

09If something goes wrong

We keep a written incident plan. If a security incident affects personal data in your workspace, we tell you within 48 hours of finding out, with what happened, what data was involved and what we have done, so you can meet your own 72-hour duty to report to the Information Commissioner's Office. We help with that report.

10Documents and contact

Clients sign a data processing agreement before their workspace is used. The agreement, our detailed security overview and our providers' own agreements are available on request.

For any question about security or data protection, email hello@drewframe.co.uk.