Trust & security
A record is only useful if it can be trusted.
Here is plainly what HomeRekkord does with your information, who can reach it and what our labels actually mean.
Locked disclosure certificate
Reproduced with fictional values. The same block appears on the web view, the PDF, the evidence ZIP manifest and the structured JSON.
- Pack identifier
- HRK-PACK-4F21-8D0C
- Property
- 8 Sample Terrace, Sampleford SA1 1AA (fictional)
- UPRN
- 999999999001 (simulated)
- Version
- Version 1 — superseded by Version 2 on the live record
- Locked at
- 12 July 2026, 09:41 UTC by D. Reviewer
- Scoring model
- Readiness 1.2 · Evidence 1.2
- Official sources frozen
- EPC (retrieved 3 Jul), Planning (8 Jul), HMLR (3 Jul), Flood (3 Jul)
- Home Insights
- Engine 1.4 · 18 rules · 4 findings at lock
- Manifest fingerprint
- sha256:9f14c0a7…31d47ab2
- Access
- Frozen · expires 11 Aug 2026 · withdrawable by the owner
Where every line comes from
A disclosure is only defensible if its lineage is visible. This is the path each item takes before a recipient ever sees it.
Published source
EPC Register · Planning Data · HM Land Registry · Environment Agency
Retrieval
Matched by UPRN, stamped with dataset, method, time and response fingerprint
Owner evidence
Documents, declarations and trade attestations, each with a provenance label
Home Insights
Fixed ruleset compares the two and records findings with engine and rule versions
Lock
Everything above is snapshotted, hashed and given a pack identifier
Recipient
Reads the snapshot only — later changes appear separately as live source context
Private-by-default records
A property record is visible only to the people you add to it. Nothing is indexed, listed or shared publicly.
Secure sign-in
Accounts are protected by email-based sign-in with modern session handling. Signing out ends the session on that device; central management of every signed-in device is not yet available.
Role-based access
Owners, co-owners, household members and contributing contractors each see only what their role allows.
Private file storage and expiring links
Uploads are stored privately. Files are served through short-lived links rather than permanent public URLs.
Share-link controls
Every share pack is scoped to chosen sections — work, documents, reminders — can be given an expiry date and can be revoked immediately.
Provenance labels
Nothing is presented as verified unless the source supports it.
Audit history
Additions, amendments and share-pack views are recorded so the record can be relied upon.
UK GDPR rights
You can access, correct, export and erase your personal data. We act as the data controller for your account information.
Data export and deletion
Export your record at any time. Deletion requests are processed within 30 days, subject to any legal retention duties.
What our labels mean
- Official-source record
- Retrieved directly from a published government or regulator source — Ordnance Survey, HM Land Registry, the EPC register, planning data or flood and environmental data — and dated. Treat it as an authoritative record of what that source publishes, not as legal or professional advice.
- Seller declared
- A statement made by the seller, with no document behind it. Treat it as testimony from the person best placed to know, not as independently checked fact.
- Contractor supplied
- Entered by a contractor as part of a job, without further confirmation. Treat it as unverified information from that party.
- Contractor attested
- The contractor who carried out the work has confirmed the record, with their identity and a date attached. Treat it as a stronger, named confirmation than an unattested entry, not as certification.
- Read from document
- The value was read from an attached document, such as an invoice or certificate, and can be corrected by whoever added it. Check it against the source document if it matters to you.
- Professionally reviewed
- A conveyancer or other professional with access to the record has opened the evidence and logged a review. Treat this as confirmation that the item was seen, not as sign-off or certification.
- Issuer verified — not yet in general use
- Would mean the value was confirmed directly with the body that issued it. HomeRekkord does not currently operate this workflow for general use, so no entry should be read as confirmed by its issuer unless this label appears against it.
- Locked disclosure
- A dated, fixed position: the answers, documents, official-source results, Home Insights and scores exactly as they stood when the version was locked. It carries a fingerprint and can never change afterwards. If something needs to change, a new version is locked and the old one remains readable.
- Live source context
- The record as it stands right now. It keeps changing as the owner adds evidence and as official sources are re-checked, so it is never a fixed disclosure and is never part of a locked version.
- Home Insights
- Findings derived by HomeRekkord by comparing official-source records against the evidence and declarations on a record. They are prompts to check something, not professional advice, and nothing in them is independently verified.
- No record identified
- A search of that source returned nothing for this addressable location. That is an absence of a retrieved record, not a statement that no such record exists.
The assurance pack
Everything a firm's supplier assessment usually asks for, written down rather than promised on a call.
Security overview
Access control, encryption, audit trail, backups and what we do not claim.
Read itSubprocessors
Every third party that touches customer data, its purpose and processing region.
Read itData processing
Controller and processor roles, retention, deletion and how to request a signed DPA.
Read itResponsible disclosure
If you believe you have found a security issue, please contact security@homerekkord.com with enough detail to reproduce it. We will acknowledge receipt and keep you updated. Please do not test against other people's records.
An honest limitation
We run automated platform security checks and follow least-privilege access rules, but automated checks are not a substitute for an independent security audit. We hold no security certification today, and we will say so plainly until we do.