Security & Data Protection

🔐 Encrypted in transit

Every connection to Drivers Hub is served over HTTPS/TLS and protected at the edge by Cloudflare, with HSTS enforced so browsers never fall back to an insecure connection.

🧂 Passwords never stored in the clear

Passwords are hashed with scrypt (a slow, memory-hard algorithm) and salted per user. We can never see or recover your password — only verify it.

📱 Two-factor authentication

Accounts can enable app-based two-factor authentication (Google Authenticator / TOTP). The owner admin console is protected by 2FA as standard.

🗑️ Documents deleted after review

Compliance documents you upload — licence, CPC, DBS, right-to-work, proof of address — are used to verify you and then permanently deleted as soon as they're reviewed. We keep the approval result, not the file.

🚧 Strict access controls

Every account can only ever see and change its own data. Driver records, bank details and private messages are gated to the person they belong to, or the agency that legitimately works with them.

🛡️ Hardened against abuse

Login and sign-up are rate-limited, sessions are server-side and HttpOnly, and the platform sends a strict set of security headers (CSP, X-Frame-Options, no-sniff) on every response.

What we store — and what we don't

We follow data minimisation: we only keep what's needed to run the service.

✅ We keep: your account details, the approval status of your documents, your licence number, your work history and earnings, and your profile photo.
🗑️ We delete: the actual document files (licence, passport, DBS, proof of address, right-to-work) the moment an agency has reviewed them.
🚫 We never store: full payment card numbers — any card payments are processed by a PCI-DSS compliant payment provider, never on our servers.
🔒 We never sell your personal data, and we don't share it beyond the agencies and garages you choose to work with.

Your rights (UK GDPR)

Access & export — every account has a "Your data" page showing what we hold and your recent activity log.
Deletion — drivers can permanently delete their account and all associated data from their profile at any time.
Transparency — see our Privacy Policy and Terms for the full detail, including lawful basis and retention.
Data Processing Agreement — available to agencies and garages on request.

Reliability

Automated daily backups of all account, shift and platform data, with old backups pruned automatically.
Self-healing — a watchdog monitors the service and restarts it automatically if it ever goes down.

Found a security issue?

We welcome responsible disclosure. Email us and we'll respond quickly.

Report a vulnerability

Your data is protected by design