Security
Last updated: 28 October 2026. TowerTalk is a trading name of TowerTalk Ltd, a company registered in England and Wales (company number 17318142).
In short
TowerTalk holds training records, and sometimes records about students, so we try to keep the basics right and to say plainly what we do and do not have. This page lists what is in place today. How we use personal data is in our privacy policy, and the companies that handle it for us are on our sub-processors page.
What is in place today
- Staff access has a second step. Our staff admin area is open only to staff accounts that sign in with an email and password (not a social sign-in). A staff account that has set up an authenticator app must pass that second step every session before the admin area opens. We can also require every staff account to set one up; that is a setting we control. Any TowerTalk account can add an authenticator app under Account.
- Browser protections. Every page is served with a Content-Security-Policy that limits which other sites a page can load scripts, frames and connections from, plus the usual security headers: HTTPS only (HSTS), no content-type guessing, no framing by other sites, a strict referrer policy and a restricted permissions policy.
- Row level security in the database. The database itself, not only our code, restricts what each signed-in person can read and write, so one customer’s training records cannot be read by another account.
- Secrets stay on the server. The keys that give full access to our database, take payments, send email or call AI services are used only in server code. They are never sent to your browser. The only keys a browser sees are the public ones that are designed to be public.
- Verified webhooks. Payment events from Stripe are accepted only after their signature has been checked against our signing secret. The same is true of email delivery events from Resend and room events from Daily.
- Rate limits on AI features. The server routes behind our AI features apply limits per minute and per day, with fair-use ceilings for paid plans, so a script cannot run up our costs or crowd out learners.
- Bot protection at sign-up. Where Cloudflare Turnstile is switched on, a new account has to pass its check, and our sign-up form also carries a hidden trap field. We suspend accounts that match the pattern of an automated sign-up, and a person looks at any complaint.
- Checks before code is released. Our code cannot be pushed from our development machines unless the type checker, the full automated test suite and a production build all pass.
- You can delete your account. From your account page, on the web or in the app. It cancels any subscription, removes your login and your own training data, and clears the files stored under your account. Records a school holds about you are the school’s to delete. What is kept afterwards, and for how long, is set out on our delete your account page.
- Your voice. When you speak a radio call, your browser sends the recording to our server, which passes it to OpenAI to be transcribed. We do not store the audio: it is not written to our database or storage. The one exception is a verified examiner who uses the practical-test recording tool, which keeps that examiner’s recordings in private storage. Live lessons are not recorded by TowerTalk. The full statement is in the privacy policy.
- Named hosting providers. Our data is held by named providers, not by us: Supabase (database, file storage and sign-in) and Vercel (hosting), with the other companies that handle data listed on the sub-processors page.
What we do not have
We would rather you knew than assumed. Today TowerTalk does not have:
- a SOC 2 report or an ISO 27001 certificate;
- an independent penetration test report (we have reviewed our own security, but that is not independent);
- single sign-on (SSO) for schools or organisations.
If one of these matters for your school or organisation, tell us at info@towertalk.co.uk. It helps us decide what to do first.
Reporting a vulnerability
If you think you have found a security problem in TowerTalk, please email info@towertalk.co.uk (or use the contact page) with what you found and how to reproduce it. Please give us a reasonable chance to fix it before you share it more widely, and please do not access other people’s data, disrupt the service or test with real customers’ accounts. We will read what you send and reply. We do not run a paid bug bounty. Our machine-readable contact is at /.well-known/security.txt.
Contact
Questions about this page: info@towertalk.co.uk, or write to TowerTalk Ltd, Tennyson House, Cambridge Business Park, Cowley Road, Cambridge, CB4 0WZ, United Kingdom.