Security & sub-processors
This page describes the controls we operate today. PowerView UK is Cyber Essentials certified (independently assessed); the remaining controls described here are self-assessed by Annalu Pomarico (sole trader) and are not an independent audit opinion.
Every table carries an org_id and row level security is enforced in the database. A query can only return rows belonging to the signed-in user's organisation, regardless of application code.
Audit records are append-only. Database triggers reject UPDATE and DELETE, each record is SHA-256 hash-chained to the previous one, and a daily anchor seals the chain head so tampering is detectable.
Roles (Supplier Admin, Manager, Compliance, Viewer) are stored in a dedicated table and evaluated server-side. Privileged actions are re-checked on the server, not only in the interface.
All traffic is served over TLS. Database storage and uploaded files are encrypted at rest by our infrastructure providers listed below.
Sub-processors
Complete register, last reviewed 17 August 2026. Controllers are notified of any intended change with a reasonable opportunity to object.
| Provider | Purpose | Region | Transfer safeguard |
|---|---|---|---|
| Supabase Inc. (managed Postgres, authentication, file storage) | Stores compliance data, user accounts, uploaded CSV files and the audit trail. | United Kingdom (London, eu-west-2) | UK hosting — no international transfer for stored data. |
| Resend (Plus Five Five, Inc.) — transactional email delivery | Delivers report notifications, deadline alerts and account emails from @powerviewuk.co.uk. | European Union (Ireland, eu-west-1) | UK GDPR adequacy decision for the EEA; DPA in place. |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Subscription checkout, invoicing and payment records. Card data never reaches our systems. | European Union / United States | Stripe DPA with UK IDTA and Standard Contractual Clauses. |
| Cloudflare, Inc. (application hosting and edge delivery) | Serves the application and API endpoints; provides the caller IP used for rate limiting. | Global edge network, UK/EU points of presence | Cloudflare DPA with UK IDTA and Standard Contractual Clauses. |
Certifications
| ICO data protection registration | Registered — ICO reference ZC227827, data protection fee paid 20 Aug 2026. Entry published on the ICO register of fee payers at ico.org.uk/register. |
| Cyber Essentials | Certified — Cyber Essentials (Whole organisation scope). Certificate number 07954bc6-962a-4666-b157-30620ea81333, awarded 25 Aug 2026, recertification due 25 Aug 2027. Certification body CSS Assure, IASME partner Danzell (profile 3.3), assessor Daniel Hales. Cyber insurance cover issued by Sutcliffe Insurance Brokers Ltd. |
| ISO/IEC 27001 | Not certified |
PowerView UK is operated by Annalu Pomarico (sole trader). Cyber Essentials is independently assessed; the remaining controls described on this page are self-assessed and are not an independent audit opinion.
Cyber Essentials — where we actually are
Cyber Essentials certified 25 August 2026 — whole organisation scope. Recertification due 25 August 2027.
Scope defined (application, laptop, cloud services) (complete)
Single-operator scope: development laptop, hosted application and managed database.
Technical controls implemented (complete)
MFA on all administrative accounts, full-disk encryption, automatic patching, firewall enabled.
Self-assessment questionnaire completed (complete)
IASME questionnaire completed against the defined scope.
Assessment submitted to IASME/Danzell (complete)
Submitted 20 August 2026 via portal.iasme.co.uk.
Assessor review and certification decision (complete)
Certificate of Assurance issued 25 August 2026 (certificate 07954bc6-962a-4666-b157-30620ea81333, assessor Daniel Hales, CSS Assure / IASME). Cyber insurance cover issued by Sutcliffe Insurance Brokers Ltd as part of the certification.
Retention schedule
| Free Risk Check CSVs and generated reports | 12 months, then deleted and the request anonymised |
| Leads and demo requests | 24 months of inactivity |
| Payment delivery and idempotency logs | 24 months |
| Audit trail and compliance evidence | 6 years (regulatory obligation), purged after 7 years |
Retention is enforced by an automated daily purge job, not by manual housekeeping.
Service availability
A public health endpoint is available at /api/public/health for monitoring tools. It reports application and database availability only and exposes no customer data.
Security contact and incident response
Named contact: Annalu Pomarico, PowerView UK (sole trader) — annalupomarico@powerviewuk.co.uk. Machine-readable contact details are published at /.well-known/security.txt (RFC 9116).
| Vulnerability report acknowledged | Within 2 working days |
| Triage outcome and remediation plan | Within 5 working days |
| Personal data breach notified to affected controllers | Without undue delay and within 72 hours of becoming aware (UK GDPR Art. 33) |
| Service incident affecting availability | Status posted to the public health endpoint; customers emailed if data is affected |
Please do not access or modify data belonging to other organisations while testing. We do not currently operate a paid bug bounty.
Data protection details, lawful bases and data subject rights are set out in our Privacy Policy and Data Processing Agreement.