Security
DV Check exists to handle driver data — licence numbers, dates of birth, driving records. This page describes how that data is actually protected, in specifics. Everything on it is true of the system as it runs today.
Where your data lives
Everything runs in the United Kingdom. Application servers are pinned to London (Vercel, lhr1) and the database is Postgres hosted in London (AWS eu-west-2, via Supabase). All traffic — browser to us, us to DVLA — travels over TLS.
How licence data is stored
Driving licence numbers are encrypted with AES-256-GCM before they touch the database, and decrypted only on the server, only when a check needs them. They are never sent to the browser and never appear in full in the interface. Encryption keys are versioned, so a key can be rotated without losing access to existing records.
Who can see what
Each organisation's data is isolated by row-level security in the database itself — the same query physically cannot return another organisation's drivers, whatever the application code does. Within an organisation, one deliberate restriction applies: a staff member cannot be added as a driver under their own email address, because the DVLA contract requires that nobody uses the service to view their own record. A colleague manages that record instead.
Consent
No check runs without the driver's consent. The consent link emailed to a driver is single-use and expires after 14 days; the driver proves who they are by entering their 16-character DVLA driving licence number — something only the person holding the licence can produce. The consent itself is recorded against the exact declaration text the driver accepted, and expires after three years, after which a fresh consent is required.
Where the data comes from
Licence records come from DVLA's Access to Driver Data service directly. No brokers, no scraped databases, no cached third-party copies — what you see is what DVLA returned, and each result is stored as the evidence of exactly that.
Payments
Payments are handled by Stripe. Card details go from your browser to Stripe and never touch our servers; we store only the resulting credit balance and transaction references.
What we don’t claim
We do not currently hold Cyber Essentials, ISO 27001 or SOC 2 certification, and this page will not imply otherwise. What it lists is what is built. As the security posture grows, this page grows with it — not ahead of it.
Wondering what a check involves for your drivers? See the FAQ or how the service works.