Household Plan

Data and security for authorities

What your organisation receives, what it never receives, and how household information is protected. Written for privacy officers, records managers and IT security reviewers.

What you receive

  • Counts by area: by ZIP code or postcode, city or council, ward, and, in the US, condo building.
  • Measures such as households with a plan, with water for three days, with an out-of-area contact, or who know their zone.
  • Where sign-ups came from, by the links and QR codes you share.
  • A monthly report, and a season or annual report.

What you never receive

  • Names, email addresses or anything that identifies a household.
  • Any household's plan or anything a household wrote.

Records and information law

Because you receive only anonymous counts, household information is not held on your behalf. In Florida, records we create for an agency under contract are handled under Chapter 119. In the UK, we support your DPIA and any Freedom of Information request about the service.

Where data lives

  • US authorities: household accounts are kept in the United States.
  • UK authorities: household accounts are kept in the United Kingdom.
  • Processors: Cloudflare (hosting and email), Neon (database), PostHog (anonymous analytics through our own servers: no cookies, no recordings, no profiles) Zippopotam.us (finding the town for a ZIP code or postcode at sign-up), Photon by komoot (the optional address search that fills the postcode in) and Open-Meteo (looking up the place a household types).

Security

  • Encryption in transit and at rest.
  • Sign-in by one-time codes sent to email. No passwords to leak.
  • Access to production limited to the people who run the service.
  • An independent penetration test every year, with a summary available to you.
  • Security questionnaires completed on request, including CAIQ and HECVAT.

Accessibility

WCAG 2.2 AA, audited independently every year, with a conformance report (VPAT or ACR) for US buyers and an accessibility statement for UK buyers. See the accessibility statement for each guideline.

Contracts

A data processing agreement, the processor list, insurance certificates and these terms in contract form are available on request: hello@example.com.