Security & Trust

Your property data, protected

Defectly holds records of your properties, defects, and the people who work on them. Here is exactly how we keep that data safe, in plain English, with no inflated claims.

Encrypted in transit Payments handled by Stripe UK GDPR compliant

How we protect your data

Security practices we actually follow

Cloudflare in front of everything

This website and its forms sit behind Cloudflare, which filters abusive traffic and runs the Turnstile check on our contact form before anything reaches us.

Encrypted in transit

All traffic between you and Defectly, on the website, in the platform and in the mobile apps, is encrypted in transit with TLS.

Payments handled by Stripe

All card payments are processed by Stripe, a certified PCI-DSS Level 1 provider. Your card details never touch or get stored on Defectly servers.

Role-based access & organisation isolation

Every user sees only what their role allows, and each organisation's data is strictly isolated. Tenants, landlords, and contractors each get their own scoped view.

UK GDPR compliance

Defectly Ltd (company number 16764636) processes personal data in line with UK GDPR and the Data Protection Act 2018. You can request export or deletion of your data at any time.

DNS-verified business domains

Contractor businesses can prove ownership of their website domain through DNS verification, so verified badges in the directory mean something real.

Responsible disclosure

Found a vulnerability? Tell us

We welcome reports from security researchers. If you believe you have found a security vulnerability in Defectly, email [email protected] with the details and we will investigate promptly. Please give us reasonable time to fix a vulnerability before disclosing it publicly.

[email protected]

Our dedicated contact for vulnerability reports and security questions. We read and respond to every report.

Honest by design

We do not claim certifications we do not hold. What you read on this page is what we actually do, and as our security programme grows, this page grows with it.

Security questions

Where is my data stored?

With established cloud providers, and all connections to Defectly are encrypted in transit with TLS. Ask us at [email protected] if you need the provider and region for a supplier questionnaire.

Do you store my card details?

No. All payments are handled by Stripe. Card details go directly to Stripe and are never stored on, or pass through, Defectly's servers.

Who can see my properties and defects?

Only people you invite. Access is role-based and every organisation's data is isolated: a contractor assigned to one defect sees that defect, not your whole portfolio.

Are you GDPR compliant?

Yes. Defectly Ltd processes personal data in line with UK GDPR and the Data Protection Act 2018, including honouring data export and deletion requests. Our privacy policy sets out exactly what we collect and why.

Do you hold ISO 27001 or SOC 2 certification?

Not yet, and we will not pretend otherwise. We follow the practices described on this page, and if we pursue formal certification in future we will announce it here.

Questions about security?

Talk to the team, or report a vulnerability directly to [email protected].