In transit
How does data travel?
All traffic runs over HTTPS/TLS, with HTTP redirected. The web app, API and public site each use non-wildcard AWS certificates.
For IT and procurement
Trust & Security
Team Today is fully GDPR compliant, hosted on AWS in London with redundancy in Ireland, collects only the minimal data the product needs, and only the company’s two founders can access customer information. This page is the full picture an IT or procurement review needs.
Reviewed August 2026 · security questionnaires welcome
Security at a glance
Aug 2026- Hosting
- AWS Londoneu-west-2 UK
- Redundancy
- AWS Irelandeu-west-1
- Backups
- Nightly, to encrypted storage
- In transit
- HTTPS/TLS only, HTTP redirected
- Sign-in
- Office 365 or Google SSO, honouring your MFA policy
- Access
- Two founders only; no human login to production
- Subprocessors
- AWS, Google Analytics, Stripe
- Uptime
- 100% last quarter99.9% SLA on Premium
- GDPR
- Standard DPA with audit rights Compliant
- ISO 27001
- On our roadmap Not yet
Infrastructure
Where is our data stored?
On AWS in London (eu-west-2), with eu-west-1 (Ireland) as redundancy. The architecture is cloud-native with zero-downtime deployments.
Data lives in MySQL on AWS, with access restricted to private-cloud services or an IP allowlist. Backups are made nightly to encrypted storage, with access restricted to the Director of Engineering.
Hosting
Cloud-native on AWS
Londoneu-west-2Primary: app and MySQL
Irelandeu-west-1Redundancy
BackupsNightly, encrypted
Backup accessDirector of Engineering
Database accessPrivate cloud or IP allowlist
DeploymentsZero downtime
Authentication
How do people sign in?
Office 365 single sign-on or Google SSO (each honouring your organisation’s own MFA policy), or email and password, salted, hashed and compared in line with OWASP guidance. Requests are authorised via signed JWTs.
Data minimisation
What does Team Today hold about a person?
Minimal data is a design decision, not a by-product. Here is everything Team Today holds about a person, and everything it doesn’t.
Held
Only what the product needs
- Name and email
- Company, team and permissions
- Office details and floor plans
- Additional responsibilities (e.g. fire warden)
- Holiday dates
- Planned working locations
Never held
Nothing beyond that
- No payroll or salary data
- No contracts or employee documents
- No performance reviews
- No tracked locations; whereabouts are self-reported plans
- No activity monitoring or hours logging
- No sensitive personal data, by design
Who can reach customer data
People and controls
People with access2 founders
Registered data officers2
Two-factor authenticationMandated
Human login to production APINone
Platform logs7 days, then deleted
Website analyticsAnonymised
Access control
Who can access our data?
Only Team Today’s two founders have access to customer information, and the company has two registered data officers. Two-factor authentication is mandated on all internal systems and access is continuously reviewed.
There is no human login to production API servers: all changes go through the release pipeline. Platform logs are retained for 7 days and then permanently deleted, with monitoring and anomaly alerting in place; website analytics are anonymised.
Who are your subprocessors?
Three. Stripe is the only third party that holds customer information, and only for payment processing. Personal data is not shared with anyone else.
Hosting
AWS
Hosting for the application and its MySQL database, in London with Ireland as redundancy.
Website analytics
Google Analytics
Anonymised analytics for the public website.
Payments
Stripe
Payment processing. The only third party holding any customer information.
What happens if we cancel?
Your data is removed in three stages.
-
1
Users and company data purged
All users and company data (offices, car parks, desks, meeting rooms) are purged, which renders the remaining booking data useless. Deleted users are permanently removed.
-
2
Orphaned bookings deleted
That orphaned booking data is then deleted by a batch job.
-
3
Within 10 business days
Our data processing agreement commits to deleting all customer personal data within 10 business days of the contract ending.
Certifications
Are you ISO 27001 certified?
Not yet; ISO 27001 certification is on our roadmap. What is true today:
- Fully GDPR compliant
- Hosted on AWS in London with Ireland redundancy
- Minimal data collected by design
- No human access to production servers
- A standard DPA with audit rights
Contracts
GDPR and contracts
Team Today is fully GDPR compliant. A standard data processing agreement is available on request: UK law, EU standard contractual clauses for any transfer outside the EEA, breach notification without undue delay, and customer audit rights.
Support
How responsive is support?
Most support queries are answered within a few hours. As Jen Guy of Galapagos Conservation Trust put it in a published AppSource review (June 2025): “Any time we have had an issue or question it has been responded to with efficiency. The team are extraordinarily helpful!”
Reliability
What about uptime?
100%uptime last quarter
As of August 2026. Premium plans carry a contractual 99.9% uptime SLA.
Need a DPA, or have a security questionnaire for us?
Send it over. Most queries are answered within a few hours.
Security review FAQs
Are you ISO 27001 certified?
Not yet; ISO 27001 certification is on our roadmap. What is true today: fully GDPR compliant, hosted on AWS in London with Ireland redundancy, minimal data collected by design, no human access to production servers, and a standard DPA with audit rights.
Can you provide extended log retention for our incident investigation or audit requirements?
We don’t offer custom log retention. Platform logs are retained for 7 days and then permanently deleted, but admins have in-app audit logs covering account activity.
What happens to our data if we cancel?
All users and company data (offices, car parks, desks, meeting rooms) are purged, rendering the remaining booking data useless; that orphaned data is then deleted by a batch job. The DPA commits to deleting all customer personal data within 10 business days of cessation.
What PII do you hold on our users?
Name, email, company and team, permissions, office details and floor plans, additional responsibilities (like fire warden), holiday dates, and planned working locations. No sensitive personal data by design.
Where is our data stored?
On AWS in London (eu-west-2), with redundancy in Ireland (eu-west-1). Backups are encrypted and made nightly.
Who can see our data?
Only Team Today’s two founders have access to customer information. The only third party holding any customer data is Stripe, solely for payment processing.
Approve it once, then never think about it again
Team Today rolls out in minutes from the Microsoft Teams app store, with Entra ID sync for joiners and leavers. Free for teams up to 10 · from £1 per user/month · see pricing.