You are being asked to put every customer, every job and every invoice into somebody else's software. That deserves a straight account of where it goes, who can reach it, and what happens if you want it back. This page includes what we do not have yet, because a security page that only lists strengths is marketing.
Every company on Result Studio gets a separate database file, not a shared table with a company column. Your records are not sitting alongside another business's, and a query cannot accidentally cross between them. This is unusual at this price and it is the thing we would point at first.
Data sits on a UK server, not replicated to other regions. For a British business dealing with British customers that keeps the answer to "where is my data" short.
Everything between your browser or phone and Result Studio runs over HTTPS. The mobile apps hold your session token in the device keychain, not in ordinary storage.
Available on every account and enforceable across your team. Passwords are stored hashed, never in a form anyone can read, including us.
Financial figures, reporting and other people's records sit behind per-person permissions. An engineer can work their own jobs without seeing what anything is worth or what colleagues are handling.
Changes are recorded with who made them and when. If something moved and nobody admits to moving it, there is an answer.
Export contacts, deals, invoices and the rest as CSV at any time, from inside the app, without asking us. Files download too. There is no retention period designed to make leaving painful.
Your customer records are not used to train models, ours or anyone else's. The AI features in the app work on your data to help you, and it goes no further.
Bigger competitors will show you certification badges. We do not have them, and rather than hope you do not notice, here is the actual position.
No. Both are audits that cost tens of thousands of pounds a year, and at our size that money is better spent on the product. What we can tell you is what we actually do, which is everything above. If you are a business that genuinely requires a certified supplier, we are not the right choice yet, and we would rather say so than waste your procurement team's afternoon.
Not formal third-party penetration testing, no. We are a small team and that is on the list rather than in the past. Security work so far has gone into the fundamentals: separate databases, hashed passwords, permission enforcement on the server rather than only in the interface, and two-factor authentication.
There is no public status page yet, and no published uptime figure, because we would rather not quote a number we have not been measuring long enough to stand behind. Both are being built. In the meantime, if something is down, email us and you will get a human answer about what happened.
Technically yes, in the sense that anyone running a server can reach the database on it. In practice we do not go into customer workspaces, and we would ask before doing so to investigate a problem you have reported. We are not going to pretend a two-person company has the access-control theatre of a large one. What we will do is tell you the truth about it.
We would tell you, quickly, with what we know and what we do not. UK GDPR requires notifying the ICO within 72 hours where there is a risk to people's rights, and affected customers without undue delay. That is the legal floor and we would treat it as the floor rather than the target.
Databases are backed up regularly and can be restored. Because each company is a separate file, restoring one customer does not involve touching anybody else's data, which makes recovery from a mistake much less dramatic than it would otherwise be.
Import from CSV, export to CSV. Nothing about the way this is built assumes you are staying.
