Security at The Caravan Registry
Built by Towpath Digital Ltd with enterprise-grade data protection from day one. We know what we're doing — and we want you to see exactly how.
Privacy by default
Your data is private unless you explicitly choose to share it. Contact details, expenses, documents, and logs are never publicly visible.
Zero tracking
No analytics cookies, no ad networks, no data sales. We use only essential cookies required to keep you signed in.
GDPR compliant
Annual consent renewal, data export from your dashboard, and the right to deletion. We take European data protection seriously.
How we protect your data
This isn't security theatre. Here's the actual architecture.
Row-Level Security (RLS)
Every table in our database has row-level security policies enforced at the database engine level — not in application code. Your expenses, documents, engine logs, location data, and emergency contacts are only accessible to the caravan owner and invited crew. Even if our API were compromised, the database itself would reject unauthorised queries.
Authentication
Email verification is required before you can sign in. Passwords are hashed with bcrypt and checked against the Have I Been Pwned database. Sessions use secure auto-refreshing tokens with short expiry windows. We also support Google OAuth for passwordless access.
Role-based access control
User roles are stored in a dedicated table, completely separate from profile data. Admin permissions are checked via security-definer functions that bypass RLS safely — preventing recursive policy evaluation. Admin access is fully isolated from regular user data paths.
Encrypted document storage
Uploaded documents (gas safety certificates, insurance, receipts) are stored in private buckets. Access is granted via time-limited signed URLs that expire after a short window. Documents are never publicly addressable — even with the URL, access expires.
Masked communication
When someone reports an issue on your caravan, the report routes through our system. Your email address is never exposed to the reporter. You receive the report; they never see your contact details.
What's visible — and what isn't
Publicly visible
- Caravan name & type
- Dimensions & builder
- Registration numbers
- Ownership history (dates only)
- Registration status
- Navigation authority
Private to owner
- Contact email
- Expenses & receipts
- Documents (Gas Safety, insurance)
- Engine & maintenance logs
- Location history
- Emergency contacts
- Equipment details & warranties
- Pitch details
Crew & co-owner access
Caravan owners can invite co-owners and crew members via email. Co-owners receive full read/write access to the caravan's logbook data — enforced at the database level via the is_boat_owner_or_crew() function. Crew members get read-only access.
Invitations follow an accept/reject flow. No one gains access to your caravan's data without your explicit invitation and their confirmation.
Dispute & stolen caravan protections
Ownership disputes are mediated by our admin team. Supporting evidence is uploaded to private encrypted storage buckets — accessible only to the disputing parties and administrators. Caravans under active dispute are locked from registration changes.
Stolen caravans are flagged across the registry with a public alert page visible to anyone viewing the profile. Registrations are frozen until the owner resolves the stolen report, preventing bad actors from transferring ownership.
Registration is not ownership
Unlike cars, caravans in the UK have no official ownership register — no DVLA equivalent exists. Navigation authority licences confirm the right to use a park, but they don't prove who owns a vehicle.
The Caravan Registry fills this gap by letting owners link their identity to their vehicle and build a verifiable history. However, registration on this platform does not constitute legal proof of ownership. It links your account to a caravan's record so you can manage it, track costs, and receive issue reports.
For stronger proof, owners can apply for Verified Owner status by submitting documentation (gas safety certificate, insurance, purchase receipt) for admin review. Verified owners carry greater weight in dispute resolution and display a visible trust badge on their caravan's public profile.
Your data rights
Annual consent renewal
We automatically prompt you to reconfirm your GDPR consent every 12 months. No silent rollovers.
Data export
Export your data from the Settings page in your dashboard. Your data belongs to you.
Right to deletion
Request complete removal of your account and associated data at any time.
Contact us
For any privacy or security queries, email [email protected].
Part of a security-first ecosystem
The Caravan Registry is built and maintained by Towpath Digital Ltd — a UK-based team building specialist tools for the inland caravan community. The same security architecture, access controls, and data protection standards apply across every product in our ecosystem.
We're caravan owners ourselves. We built this because we'd want to trust the platform we put our own data into.