Keeping Your Data Safe

Your data, taken seriously

Scoutworks holds sensitive information about young people, their parents, and the volunteers who look after them — medical needs, emergency contacts, dates of birth, and more. Protecting that information isn't a feature we added later; it's built into how the platform works.

This article explains, in plain terms, how we keep your group's data safe and how we help you meet your own responsibilities as the people accountable for it. We've deliberately kept the technical specifics light — the kind of detail that would only be useful to someone trying to find a way in.

Where your data lives

Hosted in the EU. Both the application and the systems that send your emails run in secure European data centres. The information your group manages day to day — member records, medical details, contacts — is stored and processed in the EU.
Kept in our own infrastructure wherever possible. We host the core platform ourselves rather than scattering data across third parties. The fewer places your data travels, the smaller the risk — so we keep it close by design.
Backed up every day. Your group's data is backed up automatically on a daily basis, so it can be restored if something ever goes wrong.

Protected at every layer

Everything sits behind Cloudflare. All traffic to Scoutworks passes through Cloudflare first, which absorbs large-scale attacks and filters out malicious requests before they ever reach us.
Encrypted in transit. Every connection between you and Scoutworks is encrypted, so information can't be read as it travels over the internet.
Encrypted at rest. All data is encrypted at rest using AES-256 — the same standard relied on by banks and governments — and sensitive credentials are protected by a further layer of encryption inside the application itself.
Passwords are never stored. We keep a one-way scrambled version of your password that can't be turned back into the original — so even we can't see it.
Card details are never stored. Payment card information goes straight to our regulated payment partners and is never held by Scoutworks.

Who can see what

Not everyone in a group should see everything — and in Scoutworks, they don't.

Role-based access. Each person has a role (Group Admin, Leader, Young Leader, or Parent) that determines exactly what they can see and do.
Section-level limits. Leaders only see the members in the sections they're responsible for.
Parents see only their own children — and their access is read-only.
Groups are kept separate. If your group shares the platform with thousands of others, that's invisible to you: each group's data is isolated, and the system is built to prevent one group from ever seeing another's information.

Signing in safely

Several secure sign-in options, including passwordless magic links sent to your email.
New passwords are checked against databases of known breached passwords, so a weak or compromised password can't be used.
Sessions automatically time out after a period of inactivity, with a warning beforehand — handy on shared or family devices.
Repeated failed sign-in attempts are automatically blocked to stop anyone guessing their way in.

See Signing In to Scoutworks for the day-to-day detail.

Trusted partners

Where a specialist job genuinely needs an outside provider, we choose established, regulated companies and share only what's necessary:

Cloudflare — the security layer all our traffic sits behind.
GoCardless — Direct Debit collection from parents. GoCardless is authorised by the Financial Conduct Authority (FCA).
Stripe — billing for your Scoutworks subscription. Stripe holds the highest level of payment-industry security certification (PCI-DSS Level 1).

A full, up-to-date list of the providers we work with is available in our Privacy Policy.

Certified and insured

UK Cyber Essentials. Scoutworks holds Cyber Essentials certification — the UK Government-backed scheme that independently verifies the core controls every organisation should have in place.
Cyber insurance. We carry a cyber insurance policy, giving an added layer of protection should the worst ever happen.

Data-protection controls built into the platform

Under data-protection law, your group is the data controller for your members' information — you decide how it's used. Scoutworks is your data processor — we look after it on your behalf and act on your instructions. Our job is to make meeting your responsibilities straightforward rather than a burden, so we've built the controls directly into the platform:

Sharing a young person's data needs a parent's say-so. When a youth member needs to be shared with another Scout group, Scoutworks automatically asks their parent for explicit permission first. The child's information stays put until the parent approves — and we record who gave permission and when. You stay in control; we make exercising that control effortless.
Activity consent forms. For activities that require specific permission, parents complete and sign a consent form, and their response is recorded against the event — so you always know who's authorised.
The right to be forgotten. When a member leaves or a group closes, their data can be removed. Deletions include a short recovery window to guard against mistakes, after which the data is permanently erased.
Only the data that's needed. People only ever see the information their role requires, and we don't collect more than the platform needs to do its job.
An audit trail on sensitive actions. Key administrative actions are recorded with a timestamp and the person who carried them out.

Your part in keeping data safe

Security is a partnership. The most valuable things you can do:

Give people only the access they need — assign roles and sections carefully.
Remove leavers promptly — when a leader steps down, take their access away straight away.
Keep at least two admins — so your group is never locked out, but no more admins than necessary.
Never share logins — everyone should have their own account, so the audit trail means something.
Use a strong, unique password — or sign in with a magic link and skip the password altogether.

If you're a parent

Your child's information is only ever visible to the leaders responsible for them, and to you. You have read-only access to your own children's profiles, and nothing about your child is shared with another group without your explicit permission. If you ever have a question about how your data is handled, your group's leaders are your first point of contact — they're the ones accountable for it, with Scoutworks looking after it securely on their behalf.

What's next

Managing Permissions — control what each leader and admin can see and do.
Understanding Roles and Permissions — a full breakdown of what each role can access.
Signing In to Scoutworks — sign-in options and keeping your account secure.