Security & compliance
Trusted with the records that matter most.
Children’s details, safeguarding concerns and people’s money deserve more than “it seems to work”. Here is how StewardStack protects them, and the standards we hold ourselves to.
Working towards ISO 27001
The international security standard, with independent testing and audit
Backed up automatically
Your data copied regularly, without anyone having to remember
Safeguarding kept need-to-know
Concerns seen by your safeguarding lead and their deputies alone
Card details never stored
Payments go straight to a certified payment provider
The right people, and only them
Everyone signs in to their own account, and what they can see is decided on our servers for every request, not by hiding buttons.
A dedicated identity platform
Sign-in, sessions and password resets run on a specialist identity platform, not on code we wrote ourselves.
Three separate roles
Events, Safeguarding and Finance access are given separately, so a treasurer needn’t see safeguarding records and an Event Organiser sees only their own Events.
Preview what others see
Administrators can view the app as another role to check it, and a preview can only take access away.
Signed out when left alone
An unattended session signs itself out after a period of inactivity, with a warning first.
Access ends when they leave
Remove someone from your organisation and their access ends within a minute, on every device.
Safeguarding information on a need-to-know basis
Concerns about children and adults at risk follow safeguarding practice: shared with the people who must act, and a record nobody can quietly rewrite.
Concerns go to your safeguarding leads
Safeguarding concerns reach your safeguarding lead and their deputies alone. Other incidents go to administrators too.
Restricted cases
An Incident can be restricted so only the person leading it can see it, for when it involves a colleague.
A receipt, not the case file
Whoever reports a concern gets a receipt that it was received, without seeing what happens next.
A history of changes
Changes to people, their checks, Events and Incidents are kept in an activity history showing who did what, and when.
Signed, fixed copies
Pre-Event risk assessments and Event summaries are signed and kept as copies that can’t be edited afterwards.
Personal data, looked after
We collect what your work needs, keep it no longer than you choose, and protect the most sensitive details further.
Encrypted on the way
Every page and connection to StewardStack is served over HTTPS.
Retention you set
Choose how long sensitive registration details are kept after an Event, and they are redacted automatically when that time is up.
Tax identifiers encrypted
Donors’ Irish PPS numbers are encrypted when stored and shown masked.
Card details never touch us
Payments are entered with a certified payment provider, so card numbers are never stored by StewardStack.
There when you need it
The register has to open on the morning of the Event. We build and run StewardStack so it does.
Automatic backups
Your data is backed up automatically and regularly.
Errors reported to us
Errors are reported to our team automatically, so we often know about a problem before you do.
Tested before it ships
More than 2,000 automated tests run before every change goes live.
AI assistants and integrations, on your terms
Connect an AI assistant or your own systems without handing over the keys to everything.
Your permissions, checked every time
A connected AI assistant is read only by default, you choose what it may change, and your role is checked on every request. It can never delete records or touch payments.
Its access ends with yours
Leave the organisation and your assistant’s access ends with yours.
API keys we can account for
Keys for your own systems belong to one organisation, are shown once and stored only in scrambled form, and each change made with one is marked as made through the API.
The rules you answer to, built in.
Data protection, safeguarding guidance and your accounts each come with obligations. StewardStack is shaped around them, so meeting them is part of the everyday work.
Data protection
Your organisation stays the controller of its records and we act as your processor, under a data processing agreement and our public privacy notice.
Safeguarding guidance for your Country
Checks, role titles, agencies and reporting deadlines follow your organisation’s Country, with a Safeguarding Handbook built into the app.
Records for your trustees
Refunds dated when they’re made, VAT tracked across payments, refunds and expenses, and tax relief claims built from your donation records.
Checked by people who don’t work for us.
Software that holds this kind of information is exactly what attackers look for and regulators look at, so we hold StewardStack to recognised security standards and have it tested independently.
ISO 27001
We are working towards certification against the international standard for information security, building its policies, risk management and controls into how we run StewardStack.
Independent penetration testing
Security specialists who don’t work for us try to break in, so weaknesses are found and fixed before anyone else finds them.
External audit
Certification is decided by independent auditors checking our controls against the standard, not by us marking our own homework.
Doing your due diligence?
Your trustees and safeguarding lead should ask how any system protects your people. Ask us for our security and data protection details, our data processing agreement, or anything you’d like to check. If you think you’ve found a security problem in StewardStack, please tell us through our contact form and we’ll look into it.