Encrypted everywhere
Every connection is secured with HTTPS/TLS, and data is encrypted at rest on the infrastructure that stores it. Staff National Insurance numbers get an extra layer of field-level encryption.
Security & trust
Built to protect the data you hold.
You’re trusted with children’s information — allergies, medical needs, safeguarding notes. We take that seriously, with security built into the platform and a clear split of responsibility so you always know where your data stands.
📸
How we protect it
Security measures, in plain English.
Your data is walled off
Each provider’s data is logically isolated — one provider cannot see another’s families, staff or finances.
Least-privilege access
Role-based permissions mean each person sees only their part — the office sees money, coaches see only their sessions.
Reputable hosting
Data and sign-in run on Google Cloud / Firebase, which holds recognised security certifications. The web app is hosted on Vercel and the API on Railway.
Passwords never stored
We never see your password — it’s stored only as a salted hash by our authentication provider.
Backups & resilience
Our database runs on Google Cloud (Firebase), which provides built-in storage redundancy to guard against loss.
Payments handled by Stripe
Card payments run through Stripe (PCI-DSS certified). Card numbers are never stored on our systems, and money lands in your own account.
Breach response
We have a written breach response procedure. If a personal data breach occurs we will notify the ICO within 72 hours of becoming aware of it where required, and tell affected providers without undue delay so you can meet your own duties.
People & process
Staff are bound by confidentiality and access data only where they need to.
Compliance
UK data protection, done properly.
UK GDPR & DPA 2018
We’re built to align with the UK GDPR and the Data Protection Act 2018. You are the data controller for your families’ and staff data; we act as your processor under a Data Processing Agreement you sign at set-up.
Safeguarding, inspection-ready
DBS tracking, live ratios, allergy/medical/SEND flags, medication locks and read-and-confirm policies — the evidence you need at inspection, built in.
Transparent & documented
Clear Privacy Policy, Terms and DPA, a named sub-processor list, and an export of your business records (bookings, customers, children’s records, registers, payments and more) as spreadsheets and data files: business owners export from their account, and franchise accounts export via head office. Each export’s README lists exactly what is and is not included.
Certifications
We follow security best practices. We do not currently hold formal certifications such as ISO 27001 or Cyber Essentials.
We describe the measures we take, but no system is ever completely secure. You help too — keep your login safe and give staff only the access they need.
Report a security risk
Found a vulnerability? Tell us.
Email info@activitylane.com with what you found and how to reproduce it. Please do not access, change or share anyone else’s data, and give us reasonable time to fix the problem before you tell anyone. Our contact details are also published at /.well-known/security.txt.
We will acknowledge your report within 2 working days, keep you updated while we investigate, and will not take legal action against anyone who reports a problem in good faith and follows these rules.
Questions about security?
Happy to talk it through.
Book a demo and we’ll walk you through how your data is protected — or read the detail in our policies.