25 days until digital waste tracking is mandatoryThe guide

Security

The answers your IT team
will ask for.

You are about to put your operation's waste records, your customers' addresses and your drivers' licence details into somebody else's software. Here is where it lives, who can reach it, and how you get it back out. No certifications we do not hold, and no claims we cannot show you.

Start for free Talk to us

UK

Data residency

Records and documents held in the UK

TLS 1.3

In transit

AES-256 at rest

Per-org

Isolation

Enforced in the database, not the app

Any time

Export or delete

Self-service, no ticket

How the data is held

Encrypted, isolated, and in the UK.

The parts worth knowing, stated plainly enough that you can check them.

Encrypted both ways

Everything is encrypted in transit with TLS 1.3 and at rest with AES-256. Driving licence numbers get a second layer of application-level encryption on top, because they identify a person rather than a load.

One organisation cannot see another

Isolation is enforced by row-level security in the database itself, so a query that forgets to filter by organisation returns nothing rather than somebody else's records. It is not a rule the application layer is trusted to remember.

Held in the UK

Your waste records and documents are stored in the UK, which is usually the first question and occasionally the only one.

Roles, and separate logins for the field

Admins, drivers and weighbridge operatives sign in separately and see different things. A driver's phone cannot reach your invoices, and an operative's tablet cannot reach your customer list.

Your data leaves whenever you want

Bulk export is self-service, and so is the read API on Business and above. Account deletion is self-service too. No retention hostage-taking, no ticket to raise, no notice period on getting your own records back.

Approved to file with DEFRA

LoadSnap has passed DEFRA's production approval tests and is listed on the gov.uk register of digital waste tracking software under Webhero, our company name.

What we are not

We hold no certification, and we are not going to imply otherwise.

Plenty of software in this space leans on a supplier's badge and lets you assume it is theirs. Here is the honest version, because you will find out during procurement anyway and it is better coming from us.

  • LoadSnap is not SOC 2 certified

    Supabase, our database provider, is SOC 2 Type II certified. That is their certification covering their infrastructure, not ours covering our application.

  • No ISO 27001, no Cyber Essentials

    We do not hold either. If one is a hard requirement for your procurement, tell us and we will tell you honestly where we are rather than stalling.

  • Send the questionnaire anyway

    We answer security questionnaires properly, in writing, without pretending. Most of what they ask is on this page already.

[ image ]

Questions

Good to know.

01Where is our data stored?
In the UK. Waste records, documents and photos are all held in UK infrastructure.
02Are you SOC 2 certified?
No. Our database provider, Supabase, holds SOC 2 Type II, and that covers their infrastructure rather than our application. We would rather say that clearly than let the supplier's badge do work it was not issued for. If you need certification from us specifically, we do not have it yet.
03Can another operator see our records?
No. Isolation is enforced by row-level security in the database, so it holds even if application code forgets to filter. Every table carrying customer data is covered.
04What happens to our data if we leave?
You export it and delete the account, both without asking us. The export is a full bulk download and the API stays available while your account does. We do not hold data back as a retention tactic.
05How do we report a vulnerability?
Through the contact form, or the address in our security.txt at /.well-known/security.txt. We will acknowledge it and tell you what we are doing about it.
06Who at LoadSnap can see our data?
Production access is restricted to authorised personnel and used for support and incident response, not browsing. Driving licence numbers are encrypted at the application layer on top of that.

On the DEFRA DWT Beta

The mandate is coming.
Get compliant now.

Start for free. Get started in minutes. No credit card. Build your digital audit trail today, before the deadline forces it.

Start for free Book a demo

DEFRA API integrated · EA carrier verification · UK data residency