Trust and security

FloodSense holds the register and evidence a Lead Local Flood Authority relies on for a statutory duty, so it is built to be trustworthy from the ground up. This page summarises how we protect your data. For the full security overview, a Data Processing Agreement, or our Cyber Essentials certificate, contact misi@floodsense.uk.

Where your data lives

Our primary datastore is a managed PostgreSQL database in the United Kingdom (London). Data is encrypted in transit (Transport Layer Security) and at rest, and the database is backed up with point-in-time recovery. Earth observation imagery (Copernicus Sentinel-2) is of land and water and contains no personal data.

Separation between authorities

Every authority's data is isolated in the database by Row-Level Security. The application connects with a least-privilege role that cannot bypass that isolation, so one authority can never see another's data, even in the unlikely event of an application fault.

Who can get in

• Invite-only. There is no self-registration. Access is granted only to people an administrator has provisioned, and their organisation and role are fixed to their account.
• Single sign-on with Google and Microsoft, as well as email and password.
• Password users must set a new password at first login, and can reset it themselves.
• Administrative keys are held server-side only and never exposed to the browser.

Our providers

We keep our supply chain small and reputable: Supabase (United Kingdom hosted database and sign-in), Vercel (application hosting), Brevo (transactional email), Cloudflare (domain), and Web3Forms (booking form). Each operates under a Data Processing Agreement with appropriate transfer safeguards. A full sub-processor list is available on request.

Data protection

FloodSense is provided by Astragrid Technologies Ltd, registered with the Information Commissioner's Office (registration ZB992067). We process the minimum personal data needed to run the service, and never sell it. Read our privacy policy for the detail, and our terms of use and accessibility statement.

Decision support, not determination

FloodSense reports measured area with a stated uncertainty, and an honest indicative label where an asset is below satellite resolution. A satellite signal is a prompt to inspect, not a statutory determination. The inspection and the authority's judgement remain authoritative.

Responsible disclosure

If you believe you have found a security issue, please tell us at misi@floodsense.uk so we can address it. We appreciate reports made in good faith and will work with you on a fix.

Certifications

Astragrid Technologies Ltd is Cyber Essentials certified across the whole organisation, under the United Kingdom government-backed scheme assessed by IASME (certificate 18afe630-9161-49f6-999e-e0f287b70f27, profile version 3.2 "Willow", certified 3 December 2025, recertification due 3 December 2026). We can provide the certificate on request, and are happy to discuss our security roadmap with your team.