Security Center

Last updated 10 August 2026

1. Data Protection & Privacy

You own your data. We never sell or rent personal information to third parties – full detail on what we collect, why, and who we share it with (and under what legal safeguard) is in our Privacy Policy.

Encryption

• In transit: All traffic to the app and API is encrypted with TLS, terminated at Cloudflare's edge network.
• At rest: Family and ledger data is stored in Cloudflare D1 with platform-level encryption at rest.
• Payout details: If you use Payment Bridge to save a child's payout details (sort code, account number, or similar), they're encrypted client-side with AES-GCM in a per-family key that never leaves your device or reaches our servers.

Hosting

Morechard runs entirely on Cloudflare's global network – Cloudflare Pages, Workers, and D1 – rather than a single data center. This gives us built-in DDoS protection, edge caching, and no single physical point of failure for the application layer.

2. Account Security

• Biometric sign-in: Face ID, Touch ID, and fingerprint unlock use real WebAuthn – the server independently verifies your device's cryptographic signature, and we detect and alert on signature patterns consistent with a cloned credential.
• No passwords to leak: Morechard doesn't use traditional passwords. Sign-in is via magic link and biometric/PIN unlock, so there's no password database to be breached in the first place.
• PIN protection: Repeated incorrect PIN attempts trigger an escalating lockout, from 30 seconds up to 24 hours.
• Login protection: Login attempts are rate-limited, and Cloudflare Turnstile screens out automated bot traffic on login, magic-link, and invite-redemption flows.
• Sessions: Sessions are tracked server-side and can be revoked individually or all at once – not just cleared from one device.

Family access controls

Morechard is built around families sharing access safely, including separated and co-parenting households:

• A lead parent and invited co-parents each have their own account and audit trail – nobody shares a login.
• Children see only their own chores, goals, and balance – never a sibling's or a parent's financial data.
• Access is granted by invitation, not by guesswork – there's no way to join a family account without an explicit invite.

3. Compliance & Standards

We'd rather tell you exactly where we stand than imply more than is true.

Privacy regulation

Morechard is designed around UK GDPR, GDPR-K, the ICO's Children's Code, and COPPA – data minimisation, nickname-only child profiles, and no behavioural nudging or session recording on child accounts. Full detail, including lawful bases for every category of processing, is in our Privacy Policy.

How we test what we ship

Every deploy to production is gated by a full automated test suite and a strict type-check – nothing reaches live users without passing both. In July 2026 we ran a dedicated internal security review covering authentication, session handling, and injection surface: all 284 database query sites in the codebase were confirmed to use parameterised queries with no raw SQL concatenation, our WebAuthn biometric sign-in was verified to perform genuine server-side signature checks with clone detection, and our full commit history was scanned for leaked secrets. We also run continuous automated dependency scanning to catch newly disclosed vulnerabilities in the libraries we rely on.

Independent audits & certifications

The review above was an internal, source-code-level self-assessment – not a black-box penetration test carried out by an outside firm, and we haven't commissioned one yet. We also don't currently hold SOC 2 or ISO 27001 certification – both are common asks from enterprise procurement teams, but not the standard UK schools actually look for. We're in the process of applying for Cyber Essentials, the UK government-backed baseline security certification and the one most relevant to a school-supplier relationship. An external penetration test is next on our roadmap after that, and we'll publish results here once complete.

Data Protection Impact Assessment

We maintain an internal DPIA covering children's data, the family ledger, and our AI features. It's an honest working draft, not a polished final document – see the DPIA Summary for what's assessed and what's still open, including the fact that it hasn't yet had specialist legal review.

Data Processing Agreements

We're in the process of formalising Data Processing Agreements (Article 28 GDPR) with our own key infrastructure and service providers. Our sub-processors and the international-transfer safeguards already in place for each are listed in Section 4 of our Privacy Policy. For schools evaluating a pilot partnership, see our School Partnership & Data Protection Statement, which explains exactly what data (if any) is shared and why.

Backups & recovery

Our database is continuously backed up via Cloudflare D1's point-in-time recovery, plus a daily export to separate off-platform storage retained for 30 days. We periodically test restoring from backup to confirm it actually works, not just that it runs.

4. Reporting a Vulnerability

If you believe you've found a security vulnerability in Morechard, email [email protected] with a description of the issue, steps to reproduce, and the affected URL or app version.

We aim to acknowledge reports within 2 business days and give an initial assessment within 5. Please give us reasonable time to investigate and fix an issue before any public disclosure, and avoid accessing or modifying data that isn't yours – a proof of concept is enough. We don't currently run a paid bug bounty, but we're glad to credit researchers who report responsibly.

If you suspect your account has been compromised

Email [email protected] immediately. We can revoke all active sessions on a family account and walk you through re-securing it.

5. System Status

You can check current uptime and any ongoing incidents on our public status page: stats.uptimerobot.com/Mu8Wqr2Pm2.

6. Keeping Your Account Safe

• Turn on biometric sign-in if your device supports it – it's harder to phish than a code or password.
• Never share your PIN or child invite code outside your family, including with a co-parent's new partner unless you've decided together to add them.
• Check the domain before you sign in. Official Morechard sign-in only happens at morechard.com or inside the installed app – we'll never ask for your PIN by email or text.
• Keep the app updated so you have the latest security fixes.
• Sign out of shared or borrowed devices rather than relying on it to time out.

7. For Schools

If your school is considering a Morechard pilot, these three documents are written specifically for your Designated Safeguarding Lead and Data Protection Officer:

• School Partnership & Data Protection Statement – exactly what data (if any) is shared between your school and Morechard, and why.
• DPIA Summary – what we've assessed, what mitigations are in place, and what's still open.
• Safeguarding Statement – including a feature we built and then deliberately didn't launch.

Happy to join a call with your DPO directly – email [email protected].