What we do with your data, and what we don’t have yet.
Where your data lives and how it is backed up were checked against the live system on 23 August 2026; the rest describes the product as it is built today. Where we haven’t earned a certificate, it says so — a security page that only lists good news is one nobody should believe.
Two kinds of data, two different roles
A removals firm using Cerrax is our customer, and we hold their account and their pricing settings. Their customers’ details — names, addresses, what is in the house — belong to the firm. We process those on the firm’s instructions and for no purpose of our own. Messages about a job — the quote, the booking, a reminder before the move, a payment request, a request for a video of the home, a review request afterwards — go to the firm’s customer in the firm’s name, and nothing is sent until the firm switches sending on. We never contact a firm’s customer on our own account, and never to sell them anything. The full split is in our Privacy Policy.
Where it lives, as of 23 August 2026
Customer data sits in a single Google Cloud Firestore database in the europe-west2 region (London), and the application runs on Google Cloud Run in the same region. Our public website is served by Vercel.
That is a statement of fact with a date on it, deliberately, rather than a promise. Firms in Ireland are served from the same London region: for them that is a transfer out of the EU, made lawful by the European Commission’s adequacy decision for the United Kingdom, and their own Privacy Policy says so in those terms. If where your data lives matters to your contract, ask us — we will answer it in writing for the day you ask, which is worth more than a sentence on a website that nobody re-reads.
Encryption
Everything is encrypted in transit over TLS — the app, the API, and every hosted page we serve for a firm. Data at rest in Firestore and in Google Cloud Storage is encrypted by the platform.
Who can reach what
A firm’s data is visible to that firm and to nobody else. Inside a firm, access is governed by roles and by individual permissions — an owner, a manager, a surveyor and a crew member see different things, and the permission is checked on the server for every request rather than by hiding a button.
Actions that matter — pricing settings changed, a quote overridden, a person invited or removed — are written to an audit trail with who did it and when. Anyone can turn on two-step sign-in with an authenticator app, and an owner can require it for the whole team.
Backups and recovery
Point-in-time recovery is enabled with a seven-day window, so the database can be restored to any moment inside it. A separate daily backup runs on top of that, also retained for seven days. Deletion protection is enabled on the database, so it cannot be dropped by accident or by a single mistaken command.
Payments
We never see a card. Subscriptions, deposits and balance payments all run on Stripe’s own hosted pages, and card details never touch our systems. Managing or cancelling a subscription happens on Stripe’s customer portal, from a link inside the product.
Who else is involved
We use a small number of service providers, each under contract, each named in section 8 of our Privacy Policy and kept current there rather than in two places. Today that is Google Cloud, Google Maps, Vercel, Amazon Web Services for email, Stripe for payments, and Anthropic — which reads what is typed or dictated into the capture bar, a photo of a list of items, and any file a firm chooses to import, and proposes items from them. It never sets a price. If a firm connects its own accounting software, the firm decides what goes there.
What we do not have
We are not SOC 2 or ISO 27001 certified, and we have not commissioned a penetration test. Cerrax is early, those are real costs, and we would rather tell you that than imply otherwise. We expect to do all three around our first platform partnership, and if you are evaluating us for one, say so and we will talk about timing.
We do not publish a status page yet, and we do not offer a contractual uptime guarantee. The service is monitored — uptime, error rates and response times all raise an alert to a person — but a number in a contract is a promise we are not yet in a position to make honestly.
Found something?
Email hello@cerrax.io with what you found and how to reproduce it. We will confirm we’ve received it within one working day and keep you posted on the fix. We won’t threaten anyone acting in good faith, and we’re glad to credit you if you’d like that.