Security and Your Data

Last updated: 9 November 2026.

The questions businesses ask us before they move their customers onto getSoapy, with straight answers. Our terms are what count, and we point to the section behind each answer.

Who's responsible for what

Are you our processor? Yes. For your customers' details, and anything else you keep in getSoapy about the people you deal with, you're the controller and we're your processor (terms 9.1). We're the controller for a few things we need to run getSoapy ourselves, such as your own account and billing details, payment records and fraud checks. Section 9.2 lists them.

Do you have a data processing agreement? Yes. It's Schedule 1 of our terms, and it covers what Article 28 of the UK GDPR requires. You agree to it when you agree to the terms. Download a copy to keep on file.

Where your data is

Where's it stored? Our main database and files are in data centres in London (terms 8.5).

Where are the backups? Also in London. We back up the database automatically and delete each backup after 14 days.

Who else handles it? A small number of companies help us run getSoapy, such as our hosting, messaging and AI providers. Each can use your data only to provide its service to us. Our sub-processors page lists every one, what it does and where. When one handles data outside the UK, we use the safeguards UK data protection law requires. We'll email you at least 30 days before we add or replace one, and you can object (Schedule 1, para 6).

We don't sell your data or your customers' data, and we don't use it to train AI models (terms 8.2, 8.4).

Keeping it safe

Is it encrypted? Yes. Everything between your device and our servers is encrypted, using TLS 1.2 or later. Our database, files and backups are encrypted where they're stored. Bank feed connection details get a further layer of encryption in the database.

Do you offer two-factor authentication? Yes. Anyone on your account can turn on two-step login with an authenticator app, and add recovery codes in case they lose their phone. We tell people when a login method is added to or removed from their account. Each person sets these up under More, then My Account, then Security.

How do you stop people getting in who shouldn't?

  • Everyone on your account has their own login. You choose each person's role, which limits what they can see and do.
  • Passwords are stored in a scrambled form that can't be turned back into the password. When people log in, we check passwords against lists of known breached passwords and warn them if theirs has been leaked.
  • On our side, only the people who need access to provide support or run getSoapy have it, and they use it only when they need to (terms 8.4).

The rest is up to you: don't share logins, turn on two-step login, and remove people when they leave. If you use Work offline, that device keeps a copy of your data, so keep it locked.

What happens if there's a breach? We'll tell you as soon as we can, and we aim to do it within 48 hours (terms 8.6, Schedule 1 para 8). That leaves you time to meet your own 72-hour deadline to report to the regulator, if you need to. We'll give you what you need to decide, and keep you updated.

If you think someone has got into your account, tell us straight away on hello@getsoapy.com or 0131 367 0067.

Getting your data out, and deleting it

Can we export everything? Yes. The account owner can download customers, invoices, job history, payments, expenses, rounds and services as spreadsheets from the Export Data page, one at a time or all together in one download. That download can also be emailed nightly or weekly. Documents, photos and other files download one at a time. If you need anything else, ask us (terms 7.2).

Can we have data permanently deleted? Yes. Delete a customer to remove them. Close your account to remove everything. When an account closes, we delete its data from our live systems within 90 days, including the history of changes we keep behind the scenes, not only what you see in getSoapy (terms 8.8). We keep only what the law makes us keep, such as records of payments taken through getSoapy, and what we need to settle payment disputes.

What about backups? Backups are deleted after 14 days. So once your data is deleted from our live systems, it's gone from the backups 14 days later.

Documents you can keep

Something we haven't answered? Email hello@getsoapy.com.