How we keep
your data safe.

Most security statements describe how a company protects its customer database. We don't keep one for your documents. Every tool in the GDPRGard suite is a stateless page, and nothing you upload or generate is written to server-side storage — so there's no central store of customer documents that could be breached. The only data we hold is minimal: aggregate click totals with no personal data, and, for the paid AI tools, an access code with a credit balance tied to a one-way hash of your email (see our Privacy Policy).

That's not a workaround for not having proper security — it's a deliberate minimisation strategy. The fewer places data sits, the fewer places it can leak from.

Specific, verifiable measures — not generic security-page language.

Five external services touch data as part of how the tools work. We chose each for their own track record, but we don't audit their infrastructure ourselves — for their specific security practices, their own documentation is the authoritative source.

Same principle as everywhere else on this site: we'd rather tell you what's missing than let you assume we have certifications we don't.

None of this means the tools are unsafe to use for their intended purpose — quick checks and drafts for SMB compliance tasks. It does mean that if your organisation's procurement process requires formal certifications, we don't have them yet. Tell us if you need one; that's exactly the kind of demand that tells us it's time to build it.