Scoutworks Features
Security & Access
Passkeys, two-factor with backup codes, Google and Microsoft sign-in, role-based access, a subject access request tracker and data hosted in the EU.







Passkeys — Face ID, Touch ID and Security Keys
Sign in with Face ID, Touch ID, Windows Hello, your phone's fingerprint, or a hardware security key like a YubiKey — in a single tap, with no password to remember or type. Because a passkey lives on your own device and only works on the real Scoutworks site, there is nothing to phish, guess or reuse. Set one up from your profile after confirming a code we email you, name each device, and add a second as a backup so a lost device never locks you out.
- Face ID, Touch ID, Windows Hello or your phone's fingerprint — one tap to sign in
- Hardware security keys such as a YubiKey are supported too
- Far harder to phish than a password — a passkey can't be typed into a fake login page
- When your device checks it's you — a face, a fingerprint or a PIN — the passkey also counts as your second factor
- Name each device and remove any you no longer use, and we email you whenever a passkey is added or removed
- An extra option for adult accounts, not a replacement — password and magic-link sign-in still work
Two-Factor Authentication That Remembers Your Device
Two-factor protection without a code every single week. Use an authenticator app or a code sent by email, and keep ten single-use backup codes for the day your phone is not to hand. Where your group requires two-factor and allows it, tick 'Remember this device' and Scoutworks will not ask for a code on that device for 30 days. You still sign in first every time; only the code is skipped, and only on devices you trust.
- An authenticator app or a one-time code by email — the group admin chooses which are allowed
- Ten single-use backup codes, which you can replace from your profile
- Remember a trusted device for 30 days, where your group's policy allows it
- See every remembered device with its last-used date, and forget any in one tap
- Group admins can require two-factor across the whole group
- Turning two-factor off, turning a group's rule off, or making new backup codes asks you to prove it's you again
- Five wrong codes pause sign-in for 15 minutes
Sign In With Google or Microsoft
Most volunteers already live in a Google or Microsoft account all day. Let them use it. One tap on the login page, no password to remember and no new credential to look after. If someone has already connected Google Drive to attach live documents, they're linked automatically. The login page also marks the way you signed in last time on that browser, so nobody has to remember which button they used.
- One-tap sign-in with a Google account
- One-tap sign-in with a personal Microsoft account (outlook.com, hotmail.com, live.com)
- Already connected Google Drive? You're linked automatically
- Link or unlink either account from your profile whenever you like
- A 'Last used' badge on the login page shows how you signed in last time on this browser
- Your group's two-factor rule still applies to Google and Microsoft sign-in
- scouts.org.uk work accounts aren't enabled for Microsoft sign-in yet
Roles, Section Access & Reversible Suspension
Access is scoped by role and by section, so a Beaver leader sees Beavers and a Trustee sees governance data rather than individual children's records. The server checks every request, so a change takes effect straight away. When a volunteer needs to step back — a formal suspension or simply a break — suspend their access in one action rather than deleting them. They stay in your list, badged Suspended, with their record intact, and they stop counting towards adult ratios.
- Roles for admins, leaders, Young Leaders, trustees, parents and young people, with treasurer and quartermaster access on top
- Leaders see only the sections they are assigned to — the server enforces it on every request
- Trustees get governance data, not individual children's records
- Suspend a volunteer's access in one action, with a reason and a note
- Suspended volunteers keep their history and stop counting towards adult ratios
- Reinstate restores their access with no re-signup — and nobody can suspend themselves or the last admin
- Session timeout with a warning, shared across tabs, so an unattended laptop doesn't stay signed in
Data Protection, Hosting & Portability
Your group's data is hosted in the EU (Amsterdam, the Netherlands) and processed under UK GDPR, with Scoutworks as your data processor and every sub-processor named in our privacy policy. It is encrypted in transit and at rest, the database is backed up every day, and we hold Cyber Essentials certification. You can export your data whenever you want, so leaving is always an option.
- Your group is the data controller — Scoutworks is the processor, and it's your data
- Hosted in the EU (Amsterdam, the Netherlands), with the few providers outside the EU named in our privacy policy
- Encrypted in transit and at rest, and care plans, bank details and sign-in secrets encrypted again inside the app
- Daily database backups, and 30 days to recover a group that is deleted
- Cyber Essentials certified, with cyber insurance in place
- Medical, dietary and other special-category details kept out of logs and out of the API
- Export members, badges, finances and reports as CSV or PDF at any time
Subject Access Requests & Data Deletion
When a parent or volunteer asks what you hold about them, the clock starts. The subject access request tracker records each request with a deadline one calendar month away, an owner and notes, and turns red when it is overdue. Export everything held about a member or volunteer in one file. When you need to remove data, delete just the parts you choose, and download a backup first.
- Log each request with its deadline set a calendar month from receipt
- Owner, status and notes on every request — overdue ones turn red
- Export what you hold about a member or volunteer as one file
- Delete chosen data — members, badges, events, the waiting list or emails — for chosen sections
- A preview of what will go, and a ZIP of CSV files to download before anything is deleted
- Type the group's name to confirm, so nothing goes by accident
- Group admins only
Guarding Sensitive Records
Some records need more care than others. An adult's emergency, medical and dietary details can only be opened by the leader in charge of an event they are on, a limited number of times, and every opening is logged. Uploaded files are scanned for viruses. And the API that groups use to connect their own tools can never see health information or bank details, whatever it is allowed to read.
- Only the event's leader in charge can open another adult's emergency and medical details
- Every opening of those details is logged, and repeated reads are limited
- Every uploaded file is scanned for viruses, and an infected file is refused
- API keys are read-only and never see health information, bank details or free-text notes
- New passwords are checked against known breached passwords
- Care plans are encrypted, and safeguarding plans are only ever seen by group admins
Frequently asked questions
Keep exploring
More features to discover
Other ways Scoutworks helps your group run smoothly.
Security & Access
Modern security your volunteers won't fight
Face ID sign-in, two-factor that remembers trusted devices, and your data hosted in the EU.