Project

General

Profile

Data » Security »

Data Protection and Security Pack

This pack answers the questions schools, universities and charities most often ask during procurement and data protection reviews. It is written for UK GDPR, with notes for Australian and New Zealand clients where they differ. It replaces the separate "Data Protection Information Sheet".

Contents

  1. Who we are and our role
  2. Data Processing Agreement
  3. UK GDPR compliance statement
  4. Hosting: AWS London
  5. Security architecture overview
  6. Security testing
  7. Sub-processors
  8. Retention, backups and deletion
  9. Personal data breach procedure
  10. Support access from Australia and international transfers
  11. AI safeguarding
  12. Related pages

1. Who we are and our role

Potentiality is provided by Potentiality Pty Ltd (Australia), together with its group companies.

  • Your organisation is the controller of the personal data in your Potentiality site: you decide what is collected and why.
  • Potentiality is your processor. We process that data only on your documented instructions, to provide the service.
  • Potentiality is a controller only for its own business data, for example your administrators' contact details for billing and support.

2. Data Processing Agreement

Our Service Agreement contains the data protection terms required by UK GDPR Article 28. A standalone Data Processing Agreement (DPA) is also available on request. It covers:

Article 28 requirement Our commitment
Process only on documented instructions Your site configuration and the Service Agreement are your instructions
Confidentiality All staff and contractors are bound by confidentiality obligations
Security measures (Article 32) Section 5
Sub-processors Prior notice and a right to object (section 7)
Data subject requests Administrators can find, export, correct and delete records themselves; we help on request
Breach notification and DPIAs Section 9; we supply the information you need for a DPIA
Deletion or return at the end of the contract Section 8
Audit and information rights This pack, the security assessment summary and reasonable written questionnaires
International transfers Section 10

To request a signed DPA, contact .

3. UK GDPR compliance statement

Potentiality supports your compliance with UK GDPR and the Data Protection Act 2018. For Australian clients it also supports the Privacy Act 1988.

  • Lawful basis and consent: One Click Consent collects granular opt-ins during normal site use. It stores them on each record and lets you filter every send by consent. See One Click Consent.
  • Opt-out: every bulk email carries an unsubscribe link and a List-Unsubscribe header, and unsubscribes are applied automatically.
  • Data minimisation: you choose the fields your database holds. Fields can be hidden from members or restricted to specific administrators.
  • Access control: administrator permissions are granular by area and can be limited to specific fields.
  • Subject access and portability: administrators can export a record's data to Excel at any time.
  • Erasure: administrators can delete records. Backups expire on the schedule in section 8.
  • Records of activity: activity on each site is logged and available to administrators through the site logs tool.

4. Hosting: AWS London

  • UK and European client sites are hosted by Amazon Web Services in the London region (eu-west-2):
    • the application servers;
    • the database (Amazon Aurora MySQL, across multiple availability zones, encrypted at rest);
    • file storage, caching and the web application firewall.
  • Australian and New Zealand client sites are hosted in AWS Sydney (ap-southeast-2).
  • Email delivery for UK clients uses Amazon SES in AWS Ireland (eu-west-1). Ireland is in the EEA, which the UK recognises as adequate.
  • Optional features that use services outside the UK are listed in section 7.
  • AWS certifications (ISO 27001, SOC 2 and others) are available from AWS Artifact.

Written confirmation of the London hosting arrangement can be supplied on request.

5. Security architecture overview

Network

  • All traffic is HTTPS only (TLS 1.2 or higher), with HSTS: one year, including subdomains.
  • The AWS Web Application Firewall sits in front of every site. It applies managed rule sets and rate limiting.
  • Application servers run in AWS containers (ECS) behind a load balancer. Only ports 80 and 443 are reachable from the internet.
  • Databases have no public internet access. They are reachable only from inside our private AWS network (VPC), over encrypted connections.
  • Each client's data is held in its own set of tables. It is accessed through a separate database account that can only reach that client's tables.

Application

  • Content Security Policy, CORS allow-lists and frame-ancestor restrictions on every site.
  • Sessions are held on the server, with HttpOnly cookies. Idle sessions expire after 30 minutes.
  • Passwords are stored only as salted, one-way PBKDF2-SHA512 hashes. Older hashes are upgraded automatically at the user's next sign-in.
  • Temporary sign-in codes from the password-reset process are replaced as soon as the member sets their own password.
  • Password complexity:
    • Administrators always need a strong password: at least 8 characters, with upper and lower case letters and a number.
    • Each site can extend this rule to all members.
    • The rule is checked on the server, not just in the browser.
  • Two-step verification is on by default for all administrators.
    • Signing in from an unrecognised device needs a one-time code sent by SMS, WhatsApp or email.
    • The code is valid for 20 minutes, and repeated failures lock the account temporarily.
    • Sites can require the code on every sign-in, or for all users.
  • Single sign-on is available through Google, Apple or SAML.
  • Payment cards: no card numbers pass through or are stored on Potentiality systems. Card details are entered directly into Stripe's secure fields, and we keep only Stripe's reference.
  • The application is developed following OWASP practices. See OWASP compliant coding practices.

Staff access

  • Potentiality staff work from virtual desktops that are locked to known IP addresses and protected by two-factor authentication.
  • Direct database access is limited to named engineers. It is granted on request, logged and time-limited.
  • AWS console access uses MFA and least-privilege roles. Account activity is recorded by AWS CloudTrail.
  • Application logs and alerts run through AWS CloudWatch.

6. Security testing

  • Weekly automated testing: the web application is scanned every week with OWASP ZAP.
  • Independent security assessment: an external security consultant, certified as an ISO 27001 Lead Auditor, assessed the web application in October 2025. The assessment used automated and manual testing against OWASP, PTES and NIST methods.
    • It found no critical or high-risk issues.
    • The medium and low findings have been fixed or formally risk-accepted:
      • All client-facing endpoints accept only TLS 1.2 or higher. One legacy endpoint is kept for compatibility with older devices; client sites don't use it.
      • Password strength is enforced for all administrators. Each client decides whether to enforce it for members.
    • A repeat assessment is under way (October 2026).
    • A summary is available to clients on request, under NDA.
  • Fixing findings: findings are triaged by severity. Target fix times:
Severity Target
Critical 7 days
High 30 days
Medium 90 days
Low Next scheduled release

7. Sub-processors

Core sub-processors (used for every client):

Sub-processor Purpose Data Location
Amazon Web Services Hosting, database, storage, firewall, logs All site data London (UK clients); Sydney (AU/NZ clients)
Amazon Web Services SES Email delivery Recipient email address, message content Ireland (EEA)

Optional sub-processors (used only if your organisation enables the feature):

Sub-processor Feature Data Location
Stripe Card and direct debit payments Payer name, email, payment details Stripe's regional entities (UK/EU/AU)
PayPal PayPal checkout Payer details PayPal
OpenAI (API) AI features: drafting, research, chatbot, archive scanning Limited fields only (see section 11) USA
Google Sign in with Google, reCAPTCHA, optional Google Analytics Email (sign-in); IP address (reCAPTCHA) USA / global
Apple Sign in with Apple Email USA / global
Clickatell SMS messages and administrator verification codes Mobile number, message Primarily AWS Ireland (EEA)
Bird (MessageBird) WhatsApp messages Mobile number, message Bird's regions
Mailchimp Optional Mailchimp sync Name, email, unsubscribes USA
Seats.io Event seating plans Booking references EU
Eventbrite / Humanitix / TryBooking Optional event imports Attendee details Each provider's regions
HMRC Gift Aid claims (UK) Donor name, address, donation UK
  • Address lookup and mapping use OpenStreetMap services from the browser.
  • IP geolocation uses a database held on our own servers, so IP addresses are not sent to a third party.
  • Anonymous statistics only: the engagement analysis uses a statistics function in AWS Sydney. It receives anonymous figures only (a yes/no and a number per row, with no names or identifiers).

We will give clients 30 days' notice before adding or replacing a sub-processor, so you can object.

8. Retention, backups and deletion

While you are a client

  • Your data stays in your site until you or your administrators change or delete it.
  • An automatic daily clean-up removes:
    • error logs after 4 days;
    • technical request logs after 1 month;
    • AI request logs (prompts and responses) after 2 years;
    • the audit trail after 7 years. The audit trail covers sign-ins, page and event views, registrations, payment confirmations, opt-outs and changes to records.

Backups (as at October 2026)

  • Point-in-time recovery to any second in the last 7 days.
  • Daily backups kept for 7 days.
  • Monthly backups kept for 90 days, in an AWS Backup vault in compliance mode. Nobody can alter or delete them, including Potentiality staff.
  • Uploaded files (photos, documents) are held on our file server, which is backed up on the same schedule. The copies served to browsers are generated from it.
  • All backups are encrypted and stored in the same AWS region as the live data (London for UK clients).

Deletion requests

  • A deleted record is removed from the live system immediately.
  • It stays in encrypted backups until they expire, at most 3 months later.
  • During that time it is not used for any other purpose, and it is restored only for disaster recovery.

End of contract

  • You can export your data at any time: users, events, payments, pledges and communications.
  • Within 30 days of your written request after the contract ends, we delete your site and all its database tables, and confirm this to you in writing. Backups then expire as described above.

9. Personal data breach procedure

  1. Detect and report: staff and monitoring alerts report suspected incidents to the incident lead immediately.
  2. Contain: affected systems are isolated, access is restricted, and affected credentials are changed.
  3. Assess: we establish what data was involved, which clients and how many people were affected, and the likely risk.
  4. Notify you: we notify affected clients without undue delay, and within 48 hours of becoming aware of a breach involving their data. We tell you what we know, the likely consequences and the measures taken, then send updates as the investigation progresses.
  5. Support your notification: as controller, you decide whether to notify the ICO (within 72 hours) and the individuals affected. We provide the information you need.
  6. Recover and review: systems are restored, from backups if required. The root cause is fixed, and the incident is documented and reviewed.

See also the Cyber Incident Response Plan and the Data breach process.

10. Support access from Australia and international transfers

Potentiality's support team is based in the UK and Australia, and its engineering team in Australia. Your data stays hosted in London.

  • Support provided from the UK involves no international transfer.
  • Viewing data remotely from Australia, for engineering or out-of-hours support, counts as a restricted transfer under UK GDPR. The safeguards are:
  • Transfer mechanism: the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, entered into with each UK client as part of the DPA.
  • Transfer risk assessment: completed for Australia and available on request. Australia's Privacy Act 1988 provides a comparable legal framework, and data is accessed remotely without being copied.
  • Technical safeguards:
    • data is not copied to or stored in Australia;
    • access goes through the secured virtual desktops described in section 5, over encrypted connections;
    • only named staff have access, it is logged, and it is used only when needed for support or maintenance.
  • Contractual safeguards: staff are bound by confidentiality obligations and the same security policies.

Other transfers outside the UK, for optional features (section 7), rely on one of these:

  • UK adequacy regulations: the EEA, and US companies certified under the UK Extension to the EU-US Data Privacy Framework.
  • The UK Addendum, where adequacy doesn't apply.

11. AI safeguarding

AI features are optional, and each one can be turned off.

  • Provider: OpenAI's business API, not the consumer ChatGPT service. OpenAI does not use API data to train its models.
  • What is sent: only the minimum needed.
    • Before a record is sent, contact details, addresses, dates of birth, health, financial, bank, card and private fields are removed automatically.
    • Values are also screened for personal-data patterns.
    • Fields that may be sent include name, leaving year, organisation and interests.
  • What is never sent: passwords, payment card details, bank details, medical information or internal notes.
  • Public-source research:
    • AI research uses only publicly available sources. Results are research notes for staff to check; nothing is decided automatically.
    • On UK and European sites, research does not look for contact details and does not estimate wealth or giving capacity. Those parts can only be switched on deliberately for a site.
  • Retention at OpenAI: OpenAI keeps API data for up to 30 days for abuse monitoring, then deletes it.
  • Our logs: AI requests are logged in your site's AI log for 2 years and audited daily for privacy. Any request rated as a privacy risk triggers an alert.
  • TimeWeave: see TimeWeave Privacy.

12. Related pages

sub-pages