What does a tap record?

Which tag was tapped, when, and the category of device. It is a record of presence, not of a person, until someone chooses to sign up.

Data and consent

Data, Consent and Security

Core is consent first: a tap records which tag, when and the kind of device, and nothing about the person until they choose to sign up.

Data and Consent

Presence, not behaviour. Core is consent first and records who was there, not what they did.

A tap records which tag, when, and the kind of device. Nothing about the person, until they choose to sign up.

Every consent is stored with its purpose, wording version and time. Withdrawal is honoured.
Exports are consent filtered and watermarked, with small cell suppression.
You are the controller and DEPARTMNT the processor, under UK GDPR.
Row level security in the database, fail closed defaults, and no card data stored or logged.

Core runs on Vercel, Supabase and Cloudflare, each independently certified to SOC 2 Type II and ISO 27001. Card payments are handled by Stripe, a PCI DSS Level 1 provider.

DEPARTMNT's own SOC 2 and ISO 27001 certifications are planned.

The full security and compliance page ↗

Questions

What does a tap record?: Which tag was tapped, when, and the category of device. It is a record of presence, not of a person, until someone chooses to sign up.