What the UK tier includes
| Scans processed in London | Codes on uk.sfqr.link, or on your own domain such as qr.yourcouncil.gov.uk, are served from AWS London (eu-west-2) only: the secure connection, the redirect decision, scan logs and scan statistics. A code scanned abroad is still processed in London. |
| Your own domain | Add two DNS records: one proves the domain is yours for the certificate, one routes scans to us. |
| Single sign-on | Staff sign in with your identity provider (SAML 2.0 or OpenID Connect, for example Microsoft Entra ID). When someone leaves and IT removes them, they can’t sign in any more. We switch SSO on only after checking that your organisation owns the email domain. |
| Audit-log export | Download every sign-in, set-up change and code change on your account, with old and new values, as CSV or JSON for any period of up to a year. |
| No tracking of the public | No cookies on scans, no IP addresses stored, and counts only by day and device type. |
| Codes that never expire | The same promise as every StandfastQR code: codes are never deleted, and you can export them to run without us. |
The security and DPIA pack
We send these documents to buyers who are assessing the service:
- Data Protection Impact Assessment, filled in for our processing, ready for you to adopt or adapt.
- Security overview mapped to the NCSC’s 14 Cloud Security Principles.
- Data-flow diagrams for scanning, managing codes and single sign-on, with where each item of data is stored.
- Sub-processor list: who receives what, and where.
- Cyber Essentials readiness checklist. We are working towards certification and say plainly where we are.
- Our Data Processing Agreement.
To ask for the pack, email [public-sector contact email address] with your organisation’s name and, if you have one, your procurement reference. We reply within two working days.
What we don’t claim
- DNS lookups and the scanner’s own network path are outside our control, so we don’t claim they stay in the UK.
- The dashboard you use to manage codes is delivered through a global content network; your data is stored in London.
- We are not yet on G-Cloud and don’t yet hold Cyber Essentials. We will update this page when that changes.