Our trust centre, in plain English.
Your support inbox holds some of the most sensitive things customers write to you. This is the one place to read how Solves protects it: encrypted at rest, authorised access only, metadata-only logs, built UK-first, with accessibility targeted at WCAG 2.2 AA. We are at pilot stage and say so, with full legal documents in preparation before public paid launch.
No compliance badges and no buzzwords. We describe what is built and say plainly what is still coming.
The short answer
Our posture, stated honestly
Solves is built so the sensitive part of support, the words customers write and the details they share, is encrypted before it touches the database and is only ever shown to people you have authorised. The trust centre keeps that story short and checkable.
Encrypted at rest
All customer support content is encrypted before it is stored, covering message bodies, subjects, contact names, email addresses and company names, saved replies, tags and raw inbound payloads. The cipher is XChaCha20-Poly1305, authenticated, under a per-organisation key, and each value is bound to its organisation, table and field so it cannot be moved between tenants or columns. If that binding does not match on read, decryption fails closed.
Authorised access only
Access to support content is restricted to people you have authorised, and scoped further by brand and ticket visibility. Role presets and per-brand access let you decide who can reply, who can add private notes only, and who can administer a brand. Every database query is scoped to the organisation, so no one sees beyond the boundary you set.
Metadata-only logs
We record what happened, when, and how long it took, so problems are visible before a customer reports them. Message bodies, subjects, email addresses, secrets and raw payloads never reach a log. A sanitiser strips forbidden fields, redacts anything that looks like personal data or a secret, and fails closed if dirty data reaches a log writer.
UK-first, and at pilot stage
Solves is designed for UK SMEs: prices are in GBP excluding VAT, and first-response and resolution SLA timers, with a breaching view, surface overdue tickets. We are at pilot stage, so full legal documents, including the formal terms, a data processing agreement and a complete sub-processors register, are in preparation before public paid launch.
The pages
Everything in the trust centre
Each page covers one part of how Solves handles your support data, in concrete terms.
Security overview
How customer content is encrypted at rest, how access is authorised and scoped, and how logging stays metadata only.
Read the security overviewUK data residency
Where your support content lives. Built UK-first and intended to run on a UK or EU cloud provider, without naming a region we have not yet confirmed.
See data residencyData protection
How we intend to handle personal data: what we hold, why, and the rights we will support, written honestly for pilot stage.
Read data protectionData processing agreement
The DPA that will govern how Solves processes personal data on your behalf. In preparation before public paid launch.
View the DPASub-processors
The third parties that help run the service: Postmark for email delivery, Stripe for billing, and a UK or EU cloud hosting provider.
See sub-processorsAccessibility
Our work towards WCAG 2.2 AA: where we meet the target today, where there is more to do, and how to tell us about a barrier you hit.
Read accessibilityService status
Whether the service is up and any current or recent incidents. The place to check first if something is not behaving as you expect.
Check statusReport a vulnerability
Found a security issue? Get in touch with enough detail to reproduce it and give us a reasonable chance to fix it before sharing it more widely.
Contact the teamWhere data goes
Who processes your data, and where it sits
A support desk cannot work entirely alone, so a small number of trusted services help run it. We keep that list short and named, rather than relying on a long roster you would never read.
Postmark sends and receives your support email, which is what makes the email-first ticketing work. Stripe processes billing if you are on a paid plan, so card details go to Stripe and not to us. The application runs on a UK or EU cloud hosting provider. We will not invent a provider name, region or facility here: when each specific is settled, we will state it accurately on the sub-processors page.
What we deliberately do not do
Solves is email-first, so there is no live chat, no phone or voice, no WhatsApp, no social inboxes and no omnichannel layer pulling in data from other channels. We make no guaranteed-delivery promise for outbound email, because final delivery depends on receiving mail servers we do not control. Fewer moving parts means fewer places your customers' data can travel.
Honest about pilot stage
Because Solves is in pilot, some controls are still being completed. Tenant isolation and encryption at rest are in place today, and observability data already runs on a metadata-only retention routine. Broader self-service export and deletion of support data are on the roadmap, and the formal legal documents are being prepared. As each control and document lands we will describe exactly what it does, here and in the changelog.
Need this for a buyer review?
If your security or procurement team needs to assess Solves, contact us and we will walk through our encryption, access and logging posture honestly, and flag what is shipped versus what is still in preparation. We would rather have that conversation than hand over a badge that does not mean anything.
FAQ
Trust questions, answered
Is Solves secure?
Customer content is encrypted at rest with XChaCha20-Poly1305 under per-organisation keys, access is restricted to authorised people scoped to the right organisation and brands, and logs record what happened without storing message bodies, email addresses or secrets. We describe what is built rather than carry compliance badges, and say plainly what is still coming.
Is Solves UK GDPR compliant?
We do not make a blanket compliance claim, because whether a deployment is compliant depends on how you configure and operate the product as well as on the software. We can state concretely that customer content is encrypted at rest, access is authorised and scoped, and logs are metadata only. Read the data protection page for how we intend to handle personal data.
Where is my data stored?
Solves is built UK-first and is intended to run on a UK or EU cloud hosting provider. We will not name a specific provider, region or facility until that is settled and we can state it accurately. The UK data residency page describes our intent without inventing details we cannot yet confirm.
Who else processes data when I use Solves?
Postmark sends and receives your support email, and Stripe processes billing if you are on a paid plan. Hosting runs on a UK or EU cloud provider. The sub-processors page lists each one, what it does and where it sits.
Is Solves a finished product?
Solves is at pilot stage. The support features described across the site are shipped, but full legal documents, including the formal terms, a data processing agreement and a complete sub-processors register, are in preparation before public paid launch.
How accessible is Solves?
Our accessibility work targets WCAG 2.2 AA. The application is server-rendered with semantic HTML, keyboard-reachable controls and visible focus, and the accessibility page sets out where we meet that target today and where there is more to do.
Want a security review before you commit?
Tell us what your team needs to see. We will talk you through how Solves protects support content, plainly, and be clear about what is shipped and what is still coming.