Security and your data
Your data, your device, kept safe
Where our systems run, who can see what, how a remote session is protected, and what happens to a device while it is with us. Everything on this page is checkable: it is in our privacy policy, in the headers this website sends, or in the records of the servers we run.
Six things that are true
How it is set up.
-
Your data stays in the UK and the EU
This website runs in London. Our customer system, our analytics and the server that connects remote sessions run on hardware we rent in Gravelines, France. Our mailbox and the photographs of devices in our care are with Proton, in Switzerland, which has a UK adequacy decision. Where a provider might move data further, the privacy policy names it and the safeguard it works under.
-
Our own systems, not a shared platform
We run our own customer system and our own remote-support server, rather than renting seats on somebody else's. The company that publishes the software receives none of your data. Our analytics are cookieless page counts on our own server, and nothing on this site profiles you or follows you to other sites.
-
Remote sessions you control
A remote session runs over our own server, encrypted end to end, so the relay passes it on without being able to read it. You approve the connection at your end, you see everything we do, you can end it at any moment, and no access remains once it closes. The server keeps your device's support ID, its address and the time, deletes the device record after 90 days and the connection logs after 7 days.
-
Your device in our care
We only open what the repair needs. We copy nothing from your device without a separate yes from you, and any copy we take is on our own encrypted drive and erased within 30 days of your device coming back to you. Photographs taken when a device comes in are held end-to-end encrypted and deleted 90 days after it is handed back.
-
Card details we never see
The hold that confirms a visit, and every card payment, happens on Stripe's secure pages or through Stripe on our phone. This website itself takes no payment, and we never see or keep your full card number.
-
Kept no longer than needed
An enquiry that does not become a job is deleted after 12 months, automatically. A job's records are kept for the life of the job and up to six years after, for the guarantee and the accounts. Our customer system is backed up, the backups encrypted before they leave the server and kept with a second provider in the EU.
This website
What the site itself does to protect you.
These are settings a browser or a scanner can check, not promises.
- Strict transport security
- Every page is served over HTTPS only, and browsers are told to keep it that way.
- Content security policy
- Each page tells the browser exactly which scripts and styles may run, so an injected script cannot.
- No framing, no sniffing
- The site refuses to be shown inside another site, and browsers may not second-guess file types.
- Permissions and referrers
- Camera, microphone and location are switched off for the site, and the address you came from is not passed on to others.
- No tracking cookies
- Cookieless analytics on our own server. No advertising networks, no pixels, no session recordings.
- Forms that store nothing
- The enquiry form sends your details to our inbox and our customer system and keeps nothing on the website.
Plainly
What we do not claim.
- We are a registered UK company, and the name, number and registered office are at the foot of every page.
- We hold no security certification yet, and we will not pretend to. When we do, it will be here with its number.
- If your organisation needs a security questionnaire answered or a data processing agreement before we start, email us and we will do it properly.
Questions about any of this, or something you need in writing before we start: hello@jortech.co.uk. JorTech is a trading name of TicketWave HQ Ltd, company number 17143167.