Security & trust
Safe with us — and yours to take away.
The answers self-storage operators want before they move: your data is held in the UK (with a published list of named suppliers who handle any of it elsewhere), card details never touch our servers, nothing can be quietly edited after the fact — and your reports, invoices and payments download as spreadsheets whenever you like.
01 / The guarantees
Six promises, in plain English
UK data residency
Primary application data hosted on a dedicated server in London, UK, with in-region backups. Some named sub-processors process data outside the UK under appropriate safeguards.
UK GDPR
We act as processor for your customer data and controller for your own account data, with a full data-processing agreement, and the supplier list published on this page.
Your customers' card details never touch us
Payments are handled directly by Stripe and GoCardless's own secure systems — we never see or store a full card number. (The technical standard is PCI SAQ-A, the lowest-risk compliance tier.)
Nothing edited quietly, after the fact
Every change is recorded, not just the current state — and each licence signed on StoreBay is time-stamped by an independent service, so any later change would show.
Only the right people see the right things
Every operator's data is walled off from every other operator's — enforced at the database level, not just in application code — plus strict staff access limits and two-factor authentication for our own team.
No lock-in — download your records
Download your reports, invoices and payments as spreadsheets any time. An API and webhooks are included in the plan.
02 / Is it up?
No number we can't stand behind
StoreBay is built so nothing is silently lost. We don't yet publish an uptime guarantee with a number attached, because we won't print a figure we can't stand behind yet.
03 / Who else touches your data
The named suppliers we use
04 / Legal
Read the underlying documents
No obligation · UK-based support