Security and data protection

FixDocket holds repair records for property managers, and those records hold tenants' photos and contact details. This page says where that data lives, who can reach it, and how it is protected. The privacy notice covers the same ground for the person reporting the repair.

Where your data lives

In London. The application, its database and the photo store all run in DigitalOcean's London region, and data is not moved out of the UK for storage. The services FixDocket uses around the edges -- email, bot protection, error reporting -- are listed under sub-processors below.

In transit and at rest

Every connection is over HTTPS, and the site tells browsers to use nothing else for a year (HSTS). The managed database and the object store are encrypted at rest by the hosting provider. Photos are uploaded from the tenant's or contractor's phone straight to storage over a short-lived signed URL; the file never passes through the application server.

Customers kept apart

Every record in FixDocket belongs to one organisation, and every query the application runs is filtered to the signed-in person's organisation before it reaches the database. An automated test walks every table that holds customer data and fails the build if any of them can return another customer's rows. Nothing in a URL or a form is trusted to name a record; the organisation filter applies first.

Who can sign in

Only your staff have accounts, and they are created by invitation from within your organisation. Sign-in is by email and password, with the email address confirmed before first use. Two-factor authentication with an authenticator app and sign-in with a passkey are both available to every account. Tenants, contractors and landlords never have accounts.

Links instead of accounts

Tenants report against a flat's QR code, or a link to the same form that your team emails them. Contractors and landlords open a link to one job. Each code or link carries a long random token, and FixDocket stores only a hash of it, so the token cannot be read out of the database. A contractor's link expires after 30 days and a landlord's after 90. A flat's printed code lasts until you print a new sheet, which retires the old one; a link sent to a tenant lasts until you revoke it from the flat's page, which takes one click. Every use of a link, successful or not, is written to the job's history. If a link is forwarded, the person it reaches sees that one job for the remainder of its life and nothing else -- and the job's history shows the access.

The record cannot be rewritten

A job's history is a list of events: reported, assigned, photo added, invoice uploaded, approved. The application only ever adds to that list. It has no code path that edits or deletes an event. The status shown in the console is a summary of those events, kept alongside them so the job list is quick to query; if the two ever disagreed, the events would win. Every event names who did it -- a member of staff, a tenant, a contractor, a landlord, or the system itself -- and when.

Uploads

Photos are accepted as JPEG, PNG, WebP or HEIC, invoices as PDF or an image, each with a size limit. A file is recorded against the job only after the upload is confirmed complete; anything abandoned part-way is removed by a scheduled sweep.

Bots and abuse

The public pages -- the report form and the job links -- are rate-limited per address, and the report form is protected by Cloudflare Turnstile and a hidden honeypot field. Turnstile checks the browser, not the person, and FixDocket sees only pass or fail.

Backups and erasure

The database is backed up daily by the hosting provider, with backups kept for seven days. A property manager can erase a job, a flat or a whole building from the console at any time; the records, the photos in storage and every link that pointed at them go together, and only a note that an erasure happened -- what, when, how many items -- is kept. Erased data leaves the backups as they age out, within seven days. Records that are not erased are kept for six years after the job closes, the period within which a repair can still be disputed in England and Wales.

Monitoring and errors

Application logs are collected by the hosting platform. Errors are reported to Sentry's EU service with personal data stripped before they leave the server. There is no analytics or tracking script on any page.

Roles and sub-processors

For the data in a repair record, the property manager is the controller and FixDocket is the processor: we act on your instructions and on nobody else's. The processor is Northvale Technologies Ltd, trading as FixDocket, registered in England and Wales under company number 17453725 at 277 Great Clowes Street, Salford M7 2HE. The Data Processing Agreement is part of the Terms of Service every customer accepts on signing up, so it is in place from the first day rather than arranged afterwards. The sub-processors FixDocket relies on are:

If something goes wrong

If FixDocket becomes aware of a security incident affecting your data, we tell you without undue delay and with what we know, so that you can meet your own obligations as controller. Questions about anything on this page, or a security concern, can be sent through the contact form.

Last revised September 2026.