Security at The Bike Register
Built by Towpath Digital Ltd with enterprise-grade data protection from day one.
Privacy by default
Your data is private unless you explicitly choose to share it. Contact details, expenses, documents, and logs are never publicly visible.
Zero tracking
No analytics cookies, no ad networks, no data sales. We use only essential cookies required to keep you signed in.
GDPR compliant
Annual consent renewal, data export from your dashboard, and the right to deletion. We take European data protection seriously.
How we protect your data
This isn't security theatre. Here's the actual architecture.
Row-Level Security (RLS)
Every table in our database has row-level security policies enforced at the database engine level — not in application code. Your expenses, documents, service logs, location data, and emergency contacts are only accessible to the bike owner and invited crew. Even if our API were compromised, the database itself would reject unauthorised queries.
Authentication
Email verification is required before you can sign in. Passwords are hashed with bcrypt and checked against the Have I Been Pwned database. Sessions use secure auto-refreshing tokens with short expiry windows. We also support Google OAuth for passwordless access.
Role-based access control
User roles are stored in a dedicated table, completely separate from profile data. Admin permissions are checked via security-definer functions that bypass RLS safely — preventing recursive policy evaluation. Admin access is fully isolated from regular user data paths.
Encrypted document storage
Uploaded documents (MOT certificates, V5C, insurance, receipts) are stored in private buckets. Access is granted via time-limited signed URLs that expire after a short window. Documents are never publicly addressable.
Masked communication
When someone scans your QR code or NFC tag and reports finding your bike, the report routes through our system. Your email address is never exposed to the finder. You receive the report; they never see your contact details.
What's visible — and what isn't
Publicly visible
- Bike name & type
- Make, model & colour
- Registration numbers
- Ownership history (dates only)
- Registration status
Private to owner
- Contact email
- Expenses & receipts
- Documents (MOT, V5C, insurance)
- Service & maintenance logs
- Location history
- Emergency contacts
- Equipment details & warranties
- Storage location
Crew & co-owner access
Bike owners can invite co-owners and crew members via email. Co-owners receive full read/write access to the bike's logbook data — enforced at the database level via the is_boat_owner_or_crew() function. Crew members get read-only access.
Invitations follow an accept/reject flow. No one gains access to your bike's data without your explicit invitation and their confirmation.
Dispute & stolen bike protections
Ownership disputes are mediated by our admin team. Supporting evidence is uploaded to private encrypted storage — accessible only to the disputing parties and administrators. Bikes under active dispute are locked from registration changes.
Stolen bikes are flagged across the registry with a public alert page visible to anyone viewing the profile. Registrations are frozen until the owner resolves the stolen report.
Registration is not ownership
For motorcycles and mopeds, the DVLA V5C is the official ownership document. For pushbikes and e-bikes, no official UK ownership register exists.
The Bike Register fills this gap by letting owners link their identity to their bike and build a verifiable history. However, registration on this platform does not constitute legal proof of ownership. It links your account to a bike's record so you can manage it, tag it, and receive reports.
For stronger proof, owners can apply for Verified Owner status by submitting documentation (V5C, purchase receipt, insurance) for admin review.
Your data rights
Annual consent renewal
We automatically prompt you to reconfirm your GDPR consent every 12 months. No silent rollovers.
Data export
Export your data from the Settings page in your dashboard. Your data belongs to you.
Right to deletion
Request complete removal of your account and associated data at any time.
Contact us
For any privacy or security queries, email privacy@towpath.digital.
Part of a security-first ecosystem
The Bike Register is built and maintained by Towpath Digital Ltd — a UK-based team building specialist tools for protecting your property. The same security architecture, access controls, and data protection standards apply across every product.
We're riders ourselves. We built this because we'd want to trust the platform we put our own data into.