Security & Trust

Templio is built for a UK recruitment agency's payroll and compliance data — National Insurance numbers, dates of birth, right-to-work documents, bank details. This page states plainly what protects it and where it's processed. Everything here is drawn from how the product is actually built, not a policy document written separately from the code — where we know a limitation exists, it's stated rather than left out.

Where your data is processed

Your core application data — contracts, timesheets, invoices, and contractor identity fields — lives in a single PostgreSQL database in London (Neon, eu-west-2), and application compute runs in London too (Vercel, lhr1). Neither has ever crossed a border for a database query: the compute region was moved from Washington D.C. to London in September 2026 specifically to keep it that way.

A small number of processors sit outside the UK/EU, each carrying a defined, narrow role:

Resend (email) and Sentry (error monitoring) run in the EU. Upstash (rate limiting) runs in Ireland with a United States secondary region. The full, current sub-processor list — with each one's exact purpose, region and transfer mechanism — is Annex A of our DPA, which is also what our contracts point to.

On contractors specifically: they authenticate by a single-use magic link, not a Clerk account, so no contractor's National Insurance number, pay rate or timesheet data ever reaches Clerk. Only agency staff identities (name, work email) are processed there.

Encryption

A contractor's National Insurance number and date of birth are encrypted at rest with AES-256-GCM, under a key dedicated to that purpose and kept separate from the key used for our Xero integration credentials — so a compromise of one doesn't expose the other. Uploaded documents (right-to-work evidence, insurance certificates, visas) are stored in private Blob storage and are never served from a public URL: every download is re-authenticated per request and sent with Content-Disposition: attachment, so a browser can't render a right-to-work document inline even if a link were guessed.

The audit trail is genuinely append-only

Every state-changing action in Templio writes an audit row, and the database enforces that those rows can never be altered or deleted — not by an application bug, not by an administrator, not by a compromised credential with otherwise-full database access. UPDATE, DELETE and TRUNCATE are blocked two ways at once: the database role the running application uses has those permissions revoked on the audit table, and a trigger separately raises an error if either is attempted regardless of role. Both have to be defeated, not one.

What defends an uploaded document

We removed a third-party antivirus scanner in September 2026: it sent the bytes of every uploaded document — including right-to-work evidence that can reveal nationality and immigration status — to a US-based scanning service, for every upload, whether or not the document was ever suspicious. We judged that transfer to be a larger and more certain harm than the risk it defended against, so we deleted it rather than replace it with another scanner. In its place:

• a strict file-type allow-list (PDF, JPEG, PNG only), checked against the actual bytes of the file, not just its claimed type;
• a 10 MB size cap and a sanitised file name (no path traversal);
• private storage with no public URL, Content-Disposition: attachment, and X-Content-Type-Options: nosniff;
• a Content-Security-Policy that blocks the browser from ever treating an uploaded file as executable content (object-src 'none');
• re-checked authorisation on every single download, not just at upload time; and
• human review before any uploaded document counts as valid for compliance purposes.

The accepted residual risk: a file that's a structurally valid PDF/JPEG/PNG but carries a hidden malicious payload could still be stored and downloaded by an authorised colleague at the same agency. It is never public and never rendered inline by a browser — the exposure, if any, is to that colleague's own device, defended by their own endpoint protection, not by Templio.

Tenant isolation

Every agency's data is scoped to that agency. Queries that touch contractor, timesheet or invoice data filter on the agency's own identifier and the record's own primary key together, rather than relying on a foreign-key relationship alone to keep one agency's data from another's.

Sign-in and access

Agency staff sign in through Clerk, which supports optional multi-factor authentication. Contractors never create a password at all — they authenticate with a single-use magic link that's re-validated server-side on every request, so there's no password for a contractor account to leak in the first place.

Rate limiting and platform hardening

Sign-in, magic-link and API endpoints are rate-limited (Upstash-backed). This isn't optional in production: if the rate-limiting configuration is missing, the application refuses to boot rather than silently running unprotected. Every response carries a per-request Content-Security-Policy built with a fresh nonce, so an injected inline script can't execute even if it made it into a response.

Your rights over your data

UK GDPR subject access and erasure requests are handled directly in the product: an agency can export a person's data or erase it, and our append-only audit trail is preserved even through an erasure (pseudonymised, not deleted, so a compliance history survives without retaining someone's name). See our Privacy Policy and DPA for the full detail.

Responsible disclosure

If you've found a security issue, we want to hear about it before anyone else does. Email security@templio.co.uk, or see our security.txt for the machine-readable version. We don't currently run a paid bug bounty, but we respond to every genuine report.

What we don't claim

We don't hold ISO 27001, SOC 2, or Cyber Essentials certification, and this page doesn't claim we do. If a specific certification matters to your procurement process, ask us — we'll tell you plainly where we stand rather than imply something we haven't earned.