Where the records live, and who can see them
Musterlog holds staff names, training dates and photos of premises. That's personal data, and it belongs to the organisation that collected it, not to us. Here's how that works.
You're the controller of your records. Musterlog will be the processor. Customer data will be held in the UK. Nobody outside your organisation sees an individual record unless you decide they should. Musterlog Ltd is currently in formation, and registration with the Information Commissioner's Office will be in place before any customer records are held.
What's stored
| Held | Why |
|---|---|
| Staff name and role, per site | Standard tier requires staff to be made aware of the procedures. A record of that has to say who. |
| Training completion date and signature | Evidence that awareness happened, and when. |
| Procedure documents and their versions | So you can show what was in force on a given date. |
| Drill entries, with photos | Evidence a drill took place. Photos are of premises, not people. |
| Site name, address and busiest reasonable occupancy | To work out scope and tier for each premises. |
We don't ask for dates of birth, home addresses, right to work documents, payroll numbers or anything else you don't need to show awareness. If the duty doesn't require it, we don't collect it.
Controller and processor
Under UK GDPR your organisation is the controller: you decide what's collected and why. Musterlog will be the processor, acting on your instructions under a written agreement. That agreement covers retention, deletion, sub-processors, breach notification and what happens when the licence ends.
You can export everything, at any time, in a format you can read without us. If the licence ends, you take your records with you and we delete our copy.
This is where things are most likely to go wrong, so here it is in full. When a broker funds Musterlog across a book, the policyholder remains the controller of their own records. The funder sees aggregate figures only: how much of the funded book has procedures in place, training completion rates, and which sign-ups have never been opened. They don't see named staff, the content of anyone's procedures, or any assessment of whether what a policyholder did was adequate. Policyholders are told exactly this before they start. How the broker model works.
Practical measures
- Data to be held in the UK, encrypted in transit and at rest.
- Access set per site, so a site manager sees their own premises and not the whole estate.
- An audit trail on changes to records. A record that can be quietly edited later is weaker evidence.
- You set retention. The default keeps training evidence for as long as the duty could reasonably be examined.
Where we are now
Musterlog is an early product built by a small operation. It doesn't hold ISO 27001 or a SOC 2 report. If your procurement process requires either, we can't be your supplier yet, and that's a fair position for you to take.
Before any customer records are held, we plan to have ICO registration, a written processor agreement and UK hosting in place. In the meantime we'll answer a security questionnaire straight, including the questions where the answer is no.
If you have questions about data handling, it's better to ask us than to rely on a page like this. Get in touch.