Trust & Security

ParkMeUp is not itself certified against SOC 2 or ISO 27001 today. We build on infrastructure providers who are independently audited, and we inherit the controls covered by their certifications. Our own certification work is on the roadmap.

Encryption in transit. All traffic to our application and between our services and sub-processors is encrypted with TLS (HTTPS). We set HTTP Strict Transport Security (HSTS) so browsers refuse to connect over plain HTTP, and session cookies are flagged Secure and SameSite.

Encryption at rest. Application data is stored in Supabase (managed PostgreSQL) and files in Supabase Storage; both encrypt data at rest using AES-256 as part of their managed platform. We do not operate our own database servers or disks.

Secret management. Third-party credentials (payment, email, SMS, and ANPR API keys) are held as environment variables in our hosting platform, not in the database or source code. Provider secrets that were previously stored in the database have been removed from it.

Tenant isolation. ParkMeUp is multi-tenant: every customer ("venue") has its own logical partition keyed by a venue_id. The database is not reachable directly by browsers or end-users — row-level security is enabled and denies all direct access. All data access flows through our server-side API, which resolves the signed-in user's venue from their membership record and scopes every query to that venue. One tenant cannot read or write another tenant's data.

• Managed identity. Authentication is handled by Supabase Auth. Passwords are hashed and salted by the identity provider; we never see or store plaintext passwords.
• Password policy. A minimum of 8 characters with at least one uppercase letter and one number is enforced at registration.
• Two-factor authentication. Optional one-time-code 2FA (delivered by SMS with email fallback) is available for account holders.
• Biometric sign-in. The native attendant app supports Face ID / fingerprint unlock. Biometric data never leaves the device; it only gates access to a session token that the server independently validates and expires.
• Role-based access control. Users are granted roles (e.g. admin, viewer, staff, attendant) plus fine-grained permissions and, for attendants, a restriction to specific parking areas. Sensitive configuration endpoints (payment, SMS, and ANPR settings) are gated to a restricted set of platform administrators.
• Session security. Sessions are cookie-based with Secure and SameSite attributes; attendant sessions carry an independent server-side expiry.
• Abuse protection. Authentication and payment endpoints are rate-limited.

Security-relevant and operational events are recorded to append-style activity logs, scoped per venue. Captured events include sign-in, guest check-in and check-in reversals (including the method used — QR, ANPR, or manual — and any manual override), number-plate changes, walk-in transactions, allocation changes, and payment lifecycle events from payment-provider webhooks. Contract signing keeps its own immutable audit record.

Logs are retained in our database and are available to customer administrators for their own venue. Our hosting and database providers additionally maintain infrastructure-level logs as part of their audited platforms.

• Hosting. The application runs on Vercel's serverless platform; data is stored in Supabase (managed PostgreSQL and object storage). Both are SOC 2 audited providers.
• Network posture. The application is HTTPS-only with a strict set of HTTP security headers, including a Content Security Policy, applied to every response.
• Change management. Changes are made through version control and pull requests with review before deployment. Schema changes are captured as reviewed database migrations.
• Dependencies. We use current, actively-maintained framework and library versions and monitor for security advisories.
• Roadmap. Automated CI security scanning, dependency-update automation, and a formal SDLC policy are planned as part of our SOC 2 / ISO 27001 work (see our gap analysis for the timeline).

We use the following sub-processors to deliver the service. Each is bound by a data processing agreement and is responsible for the security of its own platform. The certifications below are as published by each provider on their own trust pages and should be verified there; they are not certifications held by ParkMeUp.

* Certifications are those claimed by each provider and may change; confirm current status on the provider's trust or compliance page. A current sub-processor list is available on request.

Residency. ParkMeUp is operated for UK venues and data is hosted within our providers' managed cloud regions. We can confirm the specific hosting region for a given deployment on request.

Retention. Personal data is kept for as long as needed to provide the service, typically up to 3 years after your last interaction with us. Payment records may be retained for up to 7 years to meet financial and tax obligations. See our Privacy Policy for detail.

Portability & deletion. Customer administrators can export booking, vehicle, and registration data from the platform. Individuals may exercise UK GDPR rights — including access, correction, deletion, and portability — by contacting hello@parkmeup.co.uk.

We maintain an incident response process covering detection, triage, containment, remediation, and post-incident review. In the event of a personal-data breach, we will notify affected customers and, where the UK GDPR requires it, the Information Commissioner's Office (ICO) within the applicable timeframe. Security incidents can be reported to us at any time at security@parkmeup.co.uk.

We welcome reports from security researchers. If you believe you have found a vulnerability in ParkMeUp, please email security@parkmeup.co.uk with enough detail for us to reproduce the issue. We ask that you:

• Give us a reasonable opportunity to investigate and remediate before any public disclosure.
• Avoid privacy violations, data destruction, and any interruption or degradation of our service.
• Only interact with accounts you own or have explicit permission to test.

Acting in good faith under this policy, we will not pursue legal action against you. We do not currently operate a paid bug-bounty programme, but we are grateful for responsible reports and will acknowledge them.

Security questions, questionnaires, and disclosures: security@parkmeup.co.uk
Privacy and data-subject requests: hello@parkmeup.co.uk
Website: www.parkmeup.co.uk