Your gate data is evidence. We treat it that way.
DockLedger holds the record of who arrived at your dock, when, and what happened. That record is only worth something if it's protected and can't be tampered with. Here's how we do that — in plain English, so you can forward this page to your IT or compliance team.
One customer can never see another's data
Every record — every booking, check-in, pallet and document — is stamped with your company at the moment it's created, and the database itself enforces the wall between companies (row-level security). This isn't an app-level filter that a bug could skip: even a request that asks for another company's data gets back nothing, because the database refuses to serve it. Your data is walled off at the deepest layer of the system, and we prove it with automated tests that try to cross the wall and must fail.
Hosted in the UK, encrypted everywhere
All data lives in London (AWS eu-west-2) on Supabase, an established database platform used by hundreds of thousands of applications. It's encrypted in transit (TLS, with HSTS so browsers refuse insecure connections) and encrypted at rest. Your data does not leave the UK in normal operation.
Your card details never reach us
Payments are handled end-to-end by Stripe, the payment provider behind millions of businesses. DockLedger never sees, stores, or transmits your card number — we couldn't leak what we never hold.
People only see what their job needs
Owner, manager, office and checker roles each unlock only their part of the system — billing is owner-only, a checker's login works on the floor and nowhere else. Roles are set by your owner or manager, never by the person themselves. Support staff on our side work in a separate desk that can reach support conversations only — never your bookings, stock, or billing.
Carriers and suppliers see only their own deliveries
Each carrier and supplier gets a private portal link scoped to their deliveries alone. No shared logins, and nothing about your other partners is visible to them. Connected telematics credentials are held in a server-side vault that even the site owner's account cannot read.
The record is tamper-evident
Check-in times are stamped by the server, not typed in afterwards, and support conversations cannot be rewritten once recorded — the same property that makes a DockLedger evidence pack worth putting in front of a carrier during a demurrage dispute.
Registered and accountable
DockLedger is registered with the UK Information Commissioner's Office (registration ZC231614) and operates under UK GDPR. Who we are and where to serve documents is published on every page — see the privacy policy and terms.
Tested from the outside, and written down
On 6 September 2026 we attacked the live site from the open internet as an anonymous visitor holding only the key every browser is given. All 51 database tables: permission denied. 28 server functions: refused, except the one that is meant to be public, which returned nothing for a forged token. Every edge function with no credentials and with forged ones: 401, 403 or 404. All four storage buckets: nothing listable or downloadable. Nine pages and the service worker scanned for secrets: none. Row counts before and after: identical. One moderate finding — an unthrottled gate-search endpoint — is being fixed carefully so that a busy gatehouse wifi is not mistaken for an attacker. Three follow-up sweeps since have each closed a door. This was done by the people who wrote the code, so it is evidence, not a certificate — see below.
Reviewed every week
The platform gets a scheduled weekly security review — database permissions, access rules, response headers and dependencies are checked against a maintained baseline, and anything found is fixed, not filed.
What we don't claim
DockLedger is an early-stage product and we'd rather under-claim than impress you: we do not currently hold ISO 27001 or SOC 2 certification, and we haven't commissioned an independent penetration test yet — the black-box test above was our own, and we are the wrong people to certify our own work. Both are on the roadmap as the business grows. What you've read above is what is actually built and actually checked.
Think you've found a security issue? Tell us at hello@dockledger.co.uk and you'll get a fast, grateful response — never a legal threat.