Security overview

Access Compass · accesscompass.uk · last updated 2 October 2026

The most secure user data is the data you never hold. Access Compass has no accounts, and your saved data stays on your device, which removes whole categories of risk before they can arise. This page explains our approach plainly, for anyone running security due diligence.

Design principles

Your saved data is not on our servers. Your settings, access profile and saved items live on your device, so there is no database of them to breach, leak or ransom. Our server keeps only the corrections and video reports people choose to send, and standard request logs.
No accounts, no passwords. There is nothing to sign into, so there are no credentials to steal, phish or reuse, and no account-takeover risk.
Encrypted in transit. The app and all its content are served over HTTPS (TLS).
Least data. The app requests only what it needs. Its requests carry no account or user identity, because there is none. Like any web request, each one shows the receiving server your internet address.

Hosting and infrastructure

The website is served from Google Firebase Hosting on Google Cloud infrastructure, over an encrypted connection with a global content-delivery network. It holds no user accounts or user-created content.

Corrections, video reports and the video report count check go to our server at adaidigital.co.uk, over an encrypted connection. It runs on Google Cloud Run in London and stores reports in Google's Firestore database, which is in London too. In our admin screens, only signed-in ADAI Digital administrators can read the reports. The owners of our Google Cloud project can also reach the database directly.

Application security

The app itself is a static, client-side Progressive Web App. It has no server-side logic of its own. The reports it sends are stored and handled by our server, described above.
Third-party code is kept to a minimum and updated as part of ordinary maintenance.
Changes are verified in the real rendered app before release, including accessibility and behaviour checks.

Data handling

Because your saved data stays on your device, you hold the controls: you can view, edit and delete everything yourself, and clearing the site's storage removes it entirely. There is no copy of it on our side to recover or to lose. The reports you choose to send are the exception: we keep those so we can check them. Full detail is in our data protection statement.

Scope, honestly. Access Compass is an information and signposting directory, not a medical device and not a clinical system. We describe what we do rather than claim certifications we do not hold. Where an organisation needs formal assurance, we are glad to complete security questionnaires and share what we can.

Reporting a security concern

If you believe you have found a security issue in Access Compass, please tell us at admin@adaidigital.co.uk so we can look into it promptly. We welcome responsible disclosure and will work with you in good faith.

All policies · Data protection · Privacy · Back to Access Compass