How Railhop looks after your company's data
Your company owns its data, and Railhop processes it for you under a written Data Processing Agreement. We hold no booking logins and no bank details, the file you upload isn't kept, and journeys are deleted after 2 years.
What do you hold?
- Travellers: your company's reference for each person, their name and email address (both encrypted), and when they last appeared in an upload.
- Journeys: date, booked time, stations, ticket type, price, train company and the booking reference (encrypted).
- Claims: what was claimed, its status, the train company's claim reference, and the value and fee for billing.
- Your users' accounts: email address, sign-in methods and roles. There are no passwords.
How is it protected?
- Connections use HTTPS, and the database provider encrypts stored data at rest.
- Traveller names, email addresses and booking references are encrypted in the database (AES-256-GCM).
- Every request checks that the signed-in user belongs to the workspace and has the right role, and automated tests check that one company can't read another's data.
- Sign-in is by one-time email code or link, or Google or Apple. Business accounts are separate from personal Railhop accounts.
- Application logs record counts only, never names, stations or times.
What don't you hold?
- Logins to your booking tool or to any train company.
- Bank or card details: Stripe holds your payment details, and your admin types the company account on each claim form.
- The file you upload: Railhop reads the journeys from it and doesn't keep the file.
Railhop does not currently hold a security certification such as Cyber Essentials or ISO 27001. If it gains one, it will say so here.
Who processes data for Railhop?
Railhop's sub-processors, as listed in the Data Processing Agreement:
| Sub-processor | What it does | Where |
|---|---|---|
| Railway | Runs Railhop's servers | EU (Netherlands) |
| Neon | Database | London, UK |
| Cloudflare | Domain name services and network protection for railhop.app; receiving email sent to company inbox addresses, once that feature is in use | Global network |
| Resend | Sends Railhop's emails (sign-in codes, emails to travellers, emails to company contacts) | United States |
| Stripe | Subscriptions and payments: the company's billing name and email, and its card or Bacs Direct Debit details, which Stripe holds. Railhop never sees or stores card or bank details; it keeps only the Stripe customer id, the kind of payment method and its status | United States and Ireland |
Data Processing Agreement
The UK GDPR Article 28 terms your company accepts when it creates a workspace: the data processed, sub-processors, security, retention, breach notice, rights requests, deletion and export.
Read the Data Processing AgreementData and security questions
Is our data secure?
Data is encrypted in transit, and access to it is limited to the people who need it. We never store your travel booking logins, and there are no bank details on our server: Stripe holds your payment details. The file you upload isn't kept, only the journeys it contains.
Who owns the data? What about GDPR?
Your company does. Your company is the controller and Railhop is your processor, under a written Data Processing Agreement made under Article 28 of the UK GDPR. You accept it when you create your workspace, and you can read it first on our Data Processing Agreement page.
How long do you keep it?
Journeys and claims are kept for 2 years after the travel date for your expense records, then deleted. For submitted claims, the billing line (date, operator, stations, amounts and commission, without the traveller) is kept for 6 years for tax records, then deleted.
Who can see it?
Your company's owners and admins see your workspace, and travellers see only the claims sent to them. At Railhop, access is limited to authorised personnel of KMR Digital Ltd, bound by confidentiality, as the Data Processing Agreement sets out, including its review queue for train company replies that can't be matched automatically.
Are you registered with the ICO?
Railhop is a trading name of KMR Digital Ltd (company no. 17516682). Its registration number with the Information Commissioner's Office will be shown here once it is issued.
Do you sell our data?
No. Railhop never sells your data or shares it for marketing. Your journeys are used to find and claim your company's compensation, and otherwise only in anonymised, aggregated statistics, such as our monthly delay totals, that never identify your company or anyone in it.
Check last month's trains for free.
Upload one report and see your company's eligible compensation. No payment details required.