Built like it holds money — because it does
Contracts, valuations and payment figures are some of the most sensitive documents in construction. Here is, in plain English, how PayCycle protects them.
Your data is isolated at the database layer
Every record — projects, applications, invoices, notices, retention, CIS — is tagged with its owner, and the database itself refuses to return anyone else's rows (Postgres row-level security). This isn't just app logic that could have a bug in it; it's enforced by the data layer underneath the app.
If you create a team workspace, colleagues see that workspace's projects and nothing else. Your personal projects stay personal.
Files are private, always
Uploaded PDFs (contracts, applications), photo evidence and logos live in private storage that is never publicly accessible. The app serves them through short-lived signed links (one hour) to the signed-in owner only.
Uploads are verified by their actual file contents, not just the filename — a renamed executable doesn't get in.
Sign-in is handled by a specialist
Authentication is run by Clerk, a dedicated auth provider — PayCycle never stores or even sees your password. Two-factor authentication is available on every account.
Encrypted in transit and at rest
Everything is served over HTTPS with strict transport security. The database and file storage are encrypted at rest by our hosting providers.
Credentials you store with us — such as your own Stripe keys for invoice payment links — get an extra layer of application-level encryption (AES-256-GCM), so even a copy of the database alone couldn't expose them.
AI that works for you, not on you
When you run an AI feature, only your own document or figures for that one action are sent to our AI provider (Anthropic) to produce your result. Commercial API data is not used to train their models, and inputs are deleted by the provider within around 30 days.
Every AI suggestion is cited back to its source and rated for confidence — and nothing takes effect until you've checked and confirmed it. The AI assists; you decide.
Payments never touch our hands
If you connect Stripe for invoice payment links, money flows directly into your own Stripe account — PayCycle never holds your funds. Subscription billing is handled by Paddle, a regulated merchant of record acting on behalf of Hallett Technology Ltd.
Hardened by default
Security response headers (anti-clickjacking, MIME-sniffing protection, strict referrer policy, content-security policy), per-user rate limits on costly endpoints, signature verification with replay protection on payment webhooks, and constant-time comparison for every secret check.
Every commercially significant action is recorded in a per-project audit trail, and a documented breach-response plan exists with the UK 72-hour reporting rule built in.
Who is behind PayCycle
PayCycle is built and run by Aaron Hallett MRICS, a practising Chartered Quantity Surveyor, through Hallett Technology Ltd, registered in England and Wales (company no. 17308053). It is a real product from a named person who does this work for a living — not a white-label shell.
If we ever shut down
A fair question to ask any young product. Our commitment, and it is also in our terms: if PayCycle ever closes, you get at least 90 days' notice, full export of your data in standard formats throughout that period and for 30 days after, and a refund of any prepaid time beyond closure. Your records are yours — that does not stop being true if we stop trading.
Honest notes
PayCycle is a young product from a small team. Formal certifications (such as ISO 27001) are an ambition, not a current claim — what you read above is what is actually built and running today, no more and no less.
Found something that looks off? Tell us at hello@paycycle.uk — security reports are read first and acted on fast.
How we handle personal data is covered separately in our Privacy Policy.