NoDossier

Security and data handling

NoDossier asks people worried about their personal data to trust it with personal data. That deserves a straight answer about what happens to it, including the parts that are not finished.

True today

The free tier holds nothing
The request builder and the tracker run entirely in your browser. Your name, addresses and phone numbers are never sent to a server, so there is no copy of them for us to lose, sell, or be compelled to hand over.
There is nowhere to put an identity document
The database has no column for one and never will. Where a broker asks you to prove who you are, you send that to them directly. It is the single worst thing a service like this could hold, so we made holding it impossible rather than merely discouraged.
Identifiers are encrypted before they reach a column
For the paid tier, names, addresses, emails and phone numbers are encrypted with AES-256-GCM under keys held outside the database, so a copy of the database is not a copy of your data. Lookups use a keyed index that cannot be reversed by guessing.
We hold ourselves to Article 17
Asking us to erase you removes your identifiers, your cases, their history and any queued work. There is a test that proves every table is empty afterwards, and that nobody else's data moved.
No trackers on the tools
No analytics, no advertising pixels and no cookies on the request builder or the tracker.

Not done yet

The paid tier means acting as your agent, which means holding your data. None of the following is finished, so the paid tier is not on sale. We would rather publish the list than open the tier and hope nobody asks.

  • · Registration with the Information Commissioner's Office as a data controller
  • · A data protection impact assessment, because acting for people at scale warrants one
  • · A published privacy notice and retention schedule
  • · Data processing agreements with every subprocessor
  • · An independent security review

Telling us about a problem

If you find a security problem, write to hello@nodossier.com. We will not threaten anyone who reports one in good faith. If you find a broker route in the register that has changed or stopped working, that is worth telling us too, and it gets fixed for everyone.