Security
Security and data protection at Not A Lone Worker
This page describes how NALW looks after the data you put into it. It is written to be checked: where we say something, it is something we have verified in the product or on our servers. Last reviewed 12 November 2026.
What data NALW holds
- Account details for people who administer an account: name, work email, organisation, and a password stored only as a salted hash.
- Worker details: name, mobile number and, optionally, email for each person who receives check-ins.
- Check history: when each check was sent, on which channel, how the worker responded, any AI voice-call outcome (with a text transcript), and every escalation and acknowledgement.
- Location at check-in: a worker's GPS position is captured only when they tap to check in or raise an SOS. There is no background tracking.
- Technical logs: standard server logs (IP address, browser, timestamps).
For your workers' data, you are the controller and TNS 365 Limited is your processor. Details are in the privacy policy.
Where it is hosted
The NALW application and database run on a server in a London data centre operated by PebbleHost. The service sits behind Cloudflare for DNS, delivery and protection.
Sign-in and access
- Customers sign in with their email and password, then must enter a one-time six-digit code sent by email. Codes expire after 10 minutes, allow a limited number of attempts and are stored hashed.
- A user can choose to trust a device for 30 days, after which the code is required again.
- Passwords must be at least 8 characters and are stored only as hashes.
- Access to production systems is restricted to the people who operate the service.
Encryption and transport
Traffic to the website and console uses HTTPS (TLS). The public website sends an HTTP Strict Transport Security (HSTS) header, so browsers that have visited once will connect over HTTPS only. Backups are encrypted before they leave the server (see below).
Backups
A nightly backup of the application, its files and its database is encrypted on the server before being copied to offsite storage. A separate copy is held by TNS365 on its own infrastructure.
Sub-processors
NALW uses these third parties to run the service. The same list appears in the privacy policy.
| Provider | Purpose |
|---|---|
| Twilio | Sending text messages and placing AI voice calls |
| OpenAI | Powering the AI voice conversation and interpreting free-text replies |
| Mailgun (EU region) | Sending email check-ins, alerts and account notifications |
| Stripe | Subscription billing. Card details go direct to Stripe and are never held by NALW |
| Cloudflare | DNS, security and content delivery |
| OpenStreetMap | Map tiles displayed in the console's locations view and on a worker's check-in page |
Data retention and deletion
Check history and audit records are kept while an account is active, because they are the record of your duty of care. A customer can ask us to remove a worker's data, and when an account is closed we delete or anonymise personal data once it is no longer needed, subject to legal retention obligations. Requests go to hello@notaloneworker.com.
Data processing terms
Contact us about data processing terms: hello@notaloneworker.com.
What NALW is, for security reviews
NALW is a software service. It is not a BS 8484 service or an alarm receiving centre, and it does not contact emergency services. See standards.
Security contact
For security questions, questions about your data, or to report a concern, email hello@notaloneworker.com. Please do not send sensitive details in the first message.
Company details: TNS 365 Limited, company number 11151109. See About.
Know when your lone workers are safe
Tell us about your team and we'll arrange access or a demonstration.
From £49/month · No specialist hardware · Customer-managed escalation