Security

Last updated 23 October 2026

Your team puts real information into Trawpie: who is on the team, what they are working on, schedules, suppliers and spending. This page says plainly how that information is protected, what is in place today, and what isn't yet. If you need something here for your organisation's approval, or want to report a problem, email rushivibhandik.college@gmail.com.

🇬🇧 Stored in LondonTeam data lives in Google Cloud Firestore in London (europe-west2), under UK GDPR.

🔒 Only your team sees itDatabase rules check every read and write against the person's team and role.

💾 Backed upDaily backups kept for 30 days and weekly backups kept for 14 weeks. One team can be restored without touching the others.

📤 Yours to take awayExport your team's work to Excel or Google Sheets. Anyone can download or delete everything stored about them.

Who can see and change what

Every team has roles (Owner, Admin, Member, Viewer, plus any you create) with separate permissions: editing tasks, seeing money, managing members, changing settings, exporting.
These rules are enforced by the database itself, not only by the app's screens, so they hold even if someone bypasses the website. They are checked by automated tests on every change to the code.
Spending and budgets are visible only to roles with the finance permissions.
Deleting a task, or a member leaving the team, needs an admin's approval; open tasks are handed over, not lost.
Every task keeps a history of who changed what and when, including changes that came from GitHub.

Signing in

Sign-in is handled by Google Firebase Authentication. Trawpie never sees or stores passwords.
Sign in with a Google or Microsoft account, so a company using Google Workspace or Microsoft 365 can use work accounts, along with that company's own two-step sign-in and account policies.
People join a team only by an invitation to their email address.
Requests to the database must come from the real Trawpie app (Firebase App Check with reCAPTCHA Enterprise), which blocks scripts and bots.

Keeping it running

The site is served over HTTPS only, from Google's hosting.
Every change to the code runs the full automatic test suite (database rules, sign-in, saving, several people editing at once, phones, every language) before it can go live.
Crashes in the app or on the server are reported to the developer by email straight away. Email addresses and long numbers are removed from error reports first.
If two people save at the same moment, both changes are kept.
Backups are checked every morning; a missing backup raises an alert.

Outside services

Only these services handle your team's data, each for one job:

Google Firebase / Google Cloud: sign-in, database, hosting, backups, bot protection (London for the database).
Resend: sending emails (invitations, codes, notifications). It may process the email outside the UK under its data processing terms.
GitHub, Google Drive, Sheets and Calendar, Microsoft OneDrive: only if your team connects them. Trawpie never gets access to your code.

Full details are in the privacy policy.

Not in place yet

Trawpie is young, and it is better to say so than to let you assume. These are planned, roughly in this order:

Cyber Essentials certification (the UK government-backed security baseline).
A data processing agreement you can sign, for organisations that need one.
A public status page and a stated uptime target.
Two-step sign-in for email-and-password accounts (Google and Microsoft accounts can already use their own).
An activity log for the whole team that admins can export.
Single sign-on with your organisation's identity provider (SAML).

Reporting a security problem

If you think you've found a weakness, please email rushivibhandik.college@gmail.com with what you found and how to see it. Please don't access other people's data or disrupt the service while checking. You'll get a reply as soon as possible, and you'll be told when it's fixed.