Security
Security, stated plainly.
ReceptionOS runs on Cloudflare, and your records and files are stored in Western Europe. Data is encrypted in transit and at rest. Every record is kept separate for its organisation. We build for UK GDPR, and we say below what we don’t hold yet.
ReceptionOS is a visitor management system for UK workplaces and shared buildings, made by Fluid IT Services Ltd in Cardiff.
Your data, kept to itself.
What we store, how it is protected, and what never leaves your hands readable.
- Data is encrypted in transit and at rest.
- Every record is kept separate for its organisation and, inside a building, for the right site or tenant.
- PINs, API keys and SCIM tokens are never stored readable, and secrets are shown once.
- Every part of the service sends strict security headers and a content security policy, and this website runs no advertising or tracking scripts.
Who can see what.
Access follows the job someone does, from the owner to the host.
- There are six roles: owner, site manager, front desk, warden, tenant admin and host. An organisation can have more than one owner, and the last owner can't be removed.
- Add each tenant company and give it a tenant admin who sees only their own people and visitors, and visits are attributed to the right company from the host.
- A tablet pairs to a reception with a six-digit code, so there are no shared passwords.
- Employees sign in with a PIN: the keypad layout shuffles on every attempt, wrong guesses trigger a lockout, and PINs are stored hashed.
Your identity provider stays in charge.
Single sign-on and SCIM directory sync are Enterprise identity: £2,400 per organisation per year, ex VAT, covering every site.
- Single sign-on works with any SAML 2.0 identity provider, is set up by the account owner in the portal, and comes with a step-by-step Microsoft Entra ID guide.
- Owners can require single sign-on, so the identity provider's multi-factor authentication and conditional access govern portal access.
- SCIM directory sync adds new staff as hosts, removes access for leavers and ends their sessions, every four hours or on demand, with a Microsoft Entra guide.
A record you can stand behind.
Show an auditor, an insurer or your IT team exactly what happened.
- A tamper-evident audit log records visits and administrator changes, and owners can verify it and export it.
- Every acceptance records the exact version of the document, and editing a document creates a new version and keeps the old one on record.
Kept only as long as you need it.
You decide how long each site keeps its visits, and what you collect in the first place.
- Retention is set for each site from 1 to 3,650 days (395 by default), and expired visits and photos are deleted automatically every night.
- A person's visits, bookings, pre-registrations, document acceptances, photos and car park exemption records are erased together, by an owner in the admin portal or by us on request.
- A visitor's photo is optional, and visitors can always skip it.
- Unused pre-registrations expire seven days after the expected arrival.
Sub-processors
Who processes data for us.
| Provider | What it does | What it handles |
|---|---|---|
| Cloudflare | Hosting, the database, file storage and email delivery | Visit records, visitor photos, documents and logos, and your organisation’s accounts and settings |
| WorkOS | Standard sign-in to the admin portal | The name and email address of each person who signs in to the portal |
| Stytch | Single sign-on and SCIM directory sync, for organisations with Enterprise identity | Staff names, email addresses, departments, job titles and phone numbers from your directory, and their single sign-on sign-ins |
| Twilio | Text messages, and WhatsApp messages through Meta, to hosts whose alerts are switched on by the host or their administrator | The host’s mobile number, and the visitor’s name, company and site in the message |
Card billing through Stripe is built but switched off, so Stripe receives nothing from us today.
Our privacy policy sets out the rest: what we collect, the lawful bases, how long we keep it and your rights.
Report a vulnerability
Found a security issue?
Email security@receptionos.co.uk with what you found and how to reproduce it. Please don’t access other people’s data or disrupt the service while you test, and give us reasonable time to fix an issue before you publish it. We won’t take action against anyone who reports in good faith.
Our security.txt file gives the same address.
What we don’t hold yet
We’d rather tell you now than have you find out from a security questionnaire. We don’t hold ISO 27001 or SOC 2.
- ReceptionOS doesn't hold Cyber Essentials yet. Planned
- ReceptionOS hasn't had an independent penetration test yet. Planned
- A subject access export from the portal is not available yet: the portal's search lists a person's records, and we help collect a copy by hand. Planned
FAQ
Questions buyers ask us.
Is ReceptionOS secure?
ReceptionOS runs on Cloudflare, encrypts data in transit and at rest, keeps every organisation’s records separate, never stores PINs, API keys or SCIM tokens readable, and keeps a tamper-evident audit log your owners can verify. We don’t hold a security certification yet, and this page says which ones we don’t have.
Where is our data stored?
Your records and files are stored in Cloudflare’s Western European data centres. During a live roll-call, names are also held on Cloudflare’s network, and each reception keeps a log of its latest 500 sign-ins and sign-outs there. Each is placed near where it was first used. We don’t yet offer a UK-only or EU-only residency guarantee.
Is it built for UK GDPR?
Yes. You set how long each site keeps its visits, from 1 day to 10 years, and expired visits and photos are deleted every night. A visitor’s photo is always optional, owners can erase a person’s records in the admin portal, and we action erasure requests too. We’re a UK company: Fluid IT Services Limited, in Cardiff.
Can you erase one person’s data?
Yes. An owner can erase a person’s visits, bookings, pre-registrations, document acceptances, photos and car park exemption records together in the admin portal, after a search by name or email address, and we action erasure requests too. Erasure doesn’t reach audit entries that record a name correction, watchlist entries, space bookings, staff accounts, webhook delivery logs for other events, or the log of recent sign-ins and sign-outs each reception keeps.
What does the audit log record?
Visits and administrator changes, each entry chained to the one before it, so an owner can verify that no record has been edited, reordered or deleted, and export the log. It doesn’t record portal sign-ins, IP addresses or devices.
Is the employee PIN an access control?
No. A PIN puts an employee on the sign-in board and the fire roll-call. It doesn’t open doors, and the kiosk doesn’t connect to access control systems yet.
How do we report a vulnerability?
Email security@receptionos.co.uk with what you found and how to reproduce it. Our security.txt file gives the same address.
See it on your own front desk.
Book a 20-minute demo on video, or on site in South Wales. If it fits, we’ll set up a 30-day pilot on a tablet you already own.
In 20 minutes we’ll show you:
- The kiosk in English, then Cymraeg
- A contractor held for approval
- A host’s email arriving
- A live roll-call across two phones, one losing signal
We reply within one working day.
