Security

Your block's records matter: leaseholders' money, notices that have legal deadlines, and personal details. This page explains how RunYourBlock is built to protect them.

Where your data lives

• Customer data is hosted in the United Kingdom: the app, its database, uploaded documents and backups.
• The few providers that handle any data outside the UK, and why, are listed on our sub-processors page.

Protecting data on the way

• Encryption in transit. Every connection to the website and the app uses HTTPS with modern TLS, and browsers are told to refuse unencrypted connections (HSTS).
• Separate addresses for each block. Each block has its own web address, and sign-in cookies are tied to that address, so a session for one block can't be used on another.

Signing in

• No passwords to steal. People sign in with a one-time link or code sent to their email.
• Two-factor authentication (2FA) with an authenticator app (TOTP) is required for account owners and directors, the people who can issue bills and send notices.
• Sign-in attempts are rate-limited, and sessions expire.

Keeping blocks apart

• Every block's data carries its block's identity, and the database enforces row-level security, so a request for one block can only ever read or change that block's records.
• Automated tests check, on every change, that one block can never see or change another block's data.

Who can see what

• Least privilege. Roles decide what each person can see and do. A leaseholder sees their own flat's bills, statements and documents. An occupier sees less. Directors see what they need to run the block.
• Our own access. We don't look at a block's data except to give support the block has asked for, or where we must to keep the Service secure or comply with the law. Support access is recorded in the block's audit trail.

A record that can't be quietly changed

• Hash-chained audit trail. Every change (who did what, and when) is written to a log in which each entry is linked to the one before by a cryptographic hash. If anyone altered or deleted an earlier entry, the chain would break and the check would fail.
• The exact documents sent to leaseholders, such as bills and notices, are stored as they were sent, so you can show what was served and when.

Backups and recovery

• Regular encrypted backups, kept separately from the live system, in the UK.
• Restore drills. A backup is only useful if it works, so we regularly restore one to a separate system and check the data.
• You can export everything at any time: records as CSV and documents in their original form.

Building it safely

• Changes are reviewed and tested automatically (including security and access-control tests) before release.
• Software dependencies are kept up to date and checked for known vulnerabilities.
• Sensitive values, such as two-factor keys, are encrypted in the database. Secrets are never stored in our code.

If something goes wrong

We have a process for investigating and dealing with security incidents. If a breach affects your block's data, we'll tell your account owner without undue delay, and within 48 hours of becoming aware of it, so your company can decide whether to report it to the regulator. Our Data Processing Agreement sets this out.

Reporting a security problem

If you think you've found a security weakness in RunYourBlock, please email hello@runyourblock.co.uk with "Security" in the subject line. Please don't access other people's data, disrupt the Service or tell anyone else until we've had a chance to fix it. We'll acknowledge your report within 2 working days and keep you updated.