UK data residency
Your database and files are hosted in the United Kingdom (London region) — no data leaves the UK for primary storage.
Per-account isolation
Database row-level security means each tutor can only ever read or write their own data — enforced by the database, not just the app.
Hashed passwords
All passwords (tutor, student and parent) are stored only as bcrypt hashes — never in plain text.
Protected files
Uploaded files live in private storage and are served only through short-lived, signed links — not public URLs.
Abuse protection
Logins are rate-limited and portal access requires both an email and a code, blocking brute-force attempts.
Encryption in transit
All traffic is served over HTTPS/TLS, and backups are managed by our infrastructure provider.
Data protection & your rights
We operate in line with the UK GDPR and the Data Protection Act 2018. Tutors are the data controllers for their students' information and we act as their processor under a Data Processing Agreement. You can export all your data or delete your account (which erases students, lessons, invoices, portal accounts, messages and files) anytime from Settings. Full detail is in our Privacy Policy.
Safeguarding & retention
Messages between tutors, students and parents are logged in one place (rather than scattered across personal chat apps) and retained for a limited period to support safeguarding and the defence of any complaint. Inactive student records and dormant free accounts are automatically cleaned up over time so personal data isn't kept longer than needed.
Reporting a vulnerability
Found a security issue? Please email security@tutor-desk.com and we'll respond promptly. Please don't publicly disclose it until we've had a chance to fix it.
Questions about security or compliance?
Contact us