Security and data protection

Last updated: 29 October 2026
Questions: info@pembee.app

This page describes the technical and organisational measures Pembee Ltd has in place to protect customer data. It sits alongside our Data Processing Agreement and Privacy Policy.

1. Hosting and data location

The full list of subprocessors is in section 12.

2. Encryption

• In transit: all connections to Pembee use TLS 1.2 or higher, and browsers are instructed to use HTTPS only (HSTS). Connections between the application and the database are also encrypted with TLS
• At rest: the database and its backups are encrypted at rest by MongoDB Atlas using AES-256. Uploaded files are encrypted at rest by Cloudinary using AES-256
• Passwords: stored only as salted hashes, never in plain text
• Payment card details: entered directly into Stripe’s payment forms. Stripe is certified to PCI DSS Level 1. Card numbers never pass through or are stored on Pembee’s servers

3. Access control

Within the product:

• Role-based access controls for administrator accounts
• One Pembee account per person. Credentials are held once, at Pembee level, rather than separately on each site. Changing a password signs the person out everywhere else, and people can see and end their active sessions at account.pembee.app
• Two-step verification available on every Pembee account, for administrators and for the people who book
• Rate limiting on sign-in attempts

Within Pembee:

• Access to production systems (database, hosting, source code and payments) is limited to the personnel who need it for their role
• Two-factor authentication is enabled on all of these systems
• The database only accepts connections from the application’s fixed IP addresses

4. Backups and redundancy

• The database runs as a three-node replica set in AWS London, with the nodes in separate availability zones. Each node holds a full copy of the data, and if one fails another takes over automatically
• Database backups are taken every hour and kept for 2 days. A daily backup is kept for 60 days
• The application itself holds no data. It is deployed from version-controlled source code, and any previous release can be redeployed

5. Data retention and deletion

Pembee holds two kinds of data: the personal data of your customers and attendees, which we process on your behalf, and our own records about you as our customer. They are retained on different terms.

• While your subscription is active: we keep your customers' and attendees' data for as long as you keep it in Pembee. You decide how long that is. You can delete user and attendee records at any time, and you are responsible for setting any retention controls we provide
• When your subscription ends: your data stays available to export for 30 days. We then delete it from our live systems, no later than 60 days after your subscription ends. Backups are overwritten on a rolling 60-day cycle, so every copy is gone within 120 days of your subscription ending. If we ever restore a backup that contains deleted data, we delete that data again. We will confirm deletion in writing on request
• Our own records about you: we keep our own records about your organisation (its name and contact details, the names and contact details of your administrators, and your account, billing and usage records) for 10 years after your subscription ends, so we can help if you come back to us with a query, such as a copy of an old receipt. See our Privacy Policy. These do not include your customers' or attendees' data
• Pembee accounts: a person's login is shared across the organisations they book with, so it is not deleted when one organisation leaves Pembee. It is deleted within 30 days of being linked to no organisation at all. Your administrators' names and contact details stay in our own records about you for the 10 years above. See clause 9.4 of the DPA and our Privacy Policy
• Outside Pembee: deletion does not reach exports you have already downloaded, or your own Stripe account, which you manage directly

The full terms are in clause 9 of our Data Processing Agreement.

6. Business continuity and disaster recovery

Our recovery point objective is one hour. Our recovery time objective is 12 hours: we aim to restore service within 12 hours of an incident being identified, including incidents that happen outside working hours, and in most cases much sooner.

For the resilience of the underlying platforms, we rely on our infrastructure providers (MongoDB Atlas, AWS and Vercel), each of which publishes its own continuity arrangements.

7. Restoration and recovery testing

We have previously restored the database from backup into a test environment to confirm that the process works. We have not needed to restore the production database from backup.

8. Vulnerability scanning and penetration testing

• Automated vulnerability alerts for third-party dependencies on our source code repository (GitHub Dependabot)
• Security updates and dependency upgrades are applied as part of ongoing maintenance
• Automated application testing as part of our development and deployment process, including end-to-end testing using Cypress
• Application errors are monitored continuously (Sentry)

An external vulnerability assessment and penetration test of the Pembee web application was carried out between 27 February and 2 March 2025. It combined automated scanning with manual testing, following the OWASP Testing Guide. No critical or high-severity findings were reported. Two medium-severity findings were reported, both relating to HTTP security response headers. Both have since been remediated.

9. Independent audits and assurance reports

Pembee Ltd is registered with the Information Commissioner’s Office (registration reference ZA923778).

Pembee does not currently hold its own independent security certification, such as ISO 27001, SOC 2 or Cyber Essentials.

The infrastructure Pembee is built on is independently audited, and each provider makes its reports available through its trust centre:

10. Security incidents

Security incidents are investigated promptly. Where a personal data breach affects customer data, affected customers are notified without undue delay in accordance with our GDPR obligations.

11. Pembee’s role

For participant and booking data, you are the controller and Pembee acts as your processor. We process this data on your documented instructions and do not use participant data for our own marketing, profiling, advertising or other unrelated purposes.

The controller language in our Privacy Policy relates to personal data concerning our direct customers, such as administrator account, billing and support data, where Pembee determines the purposes and means of processing.

People sign in with a Pembee account: one login that works with every organisation on Pembee. We are the controller for the account itself (name, email address, telephone number, credentials and sign-in security), as set out in our Privacy Policy, because it is shared across organisations rather than held for any one of them. Each organisation sees only the person's details and activity on its own site, and cannot see which other organisations the person uses Pembee with. When an organisation leaves Pembee, a person's Pembee account is kept if they still use it elsewhere, and deleted within 30 days once it is linked to no organisation at all.

The AI providers listed below (Anthropic, OpenAI and Resolve247) never receive participant or booking records from our systems. They receive only what an administrator types or pastes, together with the administrator’s own account and support details. We cannot prevent an administrator from mentioning a participant in a question or support message, and where that happens the message is processed under the same safeguards as any other personal data we send to that provider. If you connect your own AI tools or other services to Pembee, for example through our API, the data you request flows to that provider under your own agreement with them and on your instructions, not under this list.

Stripe may also act as an independent controller for certain processing required to provide its payment services and meet its own legal and regulatory obligations.

12. Subprocessors

This is our current list of subprocessors, referred to in our Data Processing Agreement as the Sub-Processor List.

Where you use Tax-Free Childcare, we also send booking and payment details to HMRC through its Childcare Service API so that payments can be validated and made. HMRC processes this data as an independent controller under its own statutory powers, not on our instructions, so it is not listed as a subprocessor.

We give at least 14 days’ notice before engaging a new subprocessor or replacing an existing one, by email to the primary administrators of every customer account and by updating this list. You can object to a change on reasonable data protection grounds, as set out in clause 5 of our Data Processing Agreement.

13. International transfers

Our application hosting and primary database are located in the UK. Files uploaded to Pembee, such as images and documents, are stored by Cloudinary in the United States. Some of the other subprocessors listed above also involve transfers of personal data to the US.

These transfers are covered by an appropriate transfer mechanism: the UK-US data bridge (the UK Extension to the EU-US Data Privacy Framework) where the vendor is certified, or otherwise the UK International Data Transfer Agreement or the European Commission’s Standard Contractual Clauses with the UK Addendum. These arrangements are incorporated through the relevant vendor’s contractual terms and DPA.

We can provide the relevant vendor DPA and transfer documentation on request.

14. Audit and compliance information

We will make available the information necessary to demonstrate compliance with our obligations under Article 28 GDPR and allow for and contribute to audits, including inspections, as required under Article 28. We would normally seek to satisfy this requirement in the first instance through relevant documentation and information regarding our technical and organisational measures.

Where a customer requests additional audit activities, such as bespoke questionnaires, remote or on-site inspections, or significant assistance from Pembee personnel, these will be subject to at least 30 days’ prior written notice, take place no more than once in any 12-month period (unless required by a supervisory authority or following a personal data breach affecting your data), be carried out during normal business hours without unreasonably disrupting our operations, and be subject to appropriate confidentiality undertakings. No audit will give access to data belonging to our other customers. We reserve the right to charge reasonable costs for such additional assistance, agreed with you in advance, except where the audit is required as a result of a breach by Pembee of its obligations under the DPA or applicable data protection law. The full terms are in clause 12 of the DPA.