Security
PTAs look after families’ names, emails and payments and, at Christmas, children’s letters to Santa. Here’s exactly how PTA Central keeps all of that safe, in plain English.
How we protect your PTA
These are the things PTA Central does today, for every PTA, on every plan.
Each PTA’s data is kept in its own separate database and folder of files, with its own encryption keys. One PTA’s information can’t be read with another PTA’s keys.
Each PTA’s database, files and backups are stored in Amazon Web Services’ London region, and emails are sent from there. Backups are made every night, encrypted and copied off the server, then deleted after 30 days. Card payments (Stripe), phone notifications and optional AI reading (Google) may be processed outside the UK.
Every page, the members’ area and the app use HTTPS (TLS). Browsers are told never to fall back to an unencrypted connection.
Passwords are stored only as scrypt hashes, never as text. New passwords are checked against common passwords and, privately, against Have I Been Pwned’s list of breached passwords: only the first five characters of a hash ever leave our server.
We follow the NCSC’s advice: long passphrases (three random words work well) instead of confusing symbol rules. At least 12 characters, 14 for super admins, and nothing based on your name, your email or your PTA.
Use an authenticator app, a passkey (Face ID, Touch ID or Windows Hello) or a code by email, with single-use recovery codes as a backup. Committee roles must use it, and the chair, treasurer, secretary, trustees and Santa’s elves need an authenticator app or passkey rather than email codes.
The app can sign you in with Face ID or a fingerprint, using a one-time device key kept in the phone’s secure storage and replaced at every sign-in. If an old key is ever used again, quick sign-in is switched off for that phone and you get an email.
You’re signed out after a while without using it, and must sign in again regularly. You can see every device you’re signed in on and sign them out, and we email you when your account is used on a new device. Repeated wrong passwords lock the account for a while.
Sign-ins, and changes to money, people, roles and settings, are written to an audit log, along with every look at Santa letter details. Your super admin can read it.
Children’s Santa letter details, bank details for claims, chat messages, two-step sign-in secrets and integration keys are encrypted in the database with AES-256-GCM. The keys are kept outside the database.
Online card payments go through Stripe Checkout, so card numbers go straight to Stripe and are covered by Stripe’s PCI DSS compliance. SumUp card readers send card details to SumUp, never to us.
Every role has only the permissions it needs. Teachers see their wish lists, helpers see events, the treasurer sees the money, and only Santa’s elves see children’s letters.
Every page has strict security headers: a content security policy that blocks injected scripts, no framing by other websites, and HTTPS enforced.
Uploads are checked by type, contents and size before they’re stored. Private files, like receipts, are only ever sent after a permission check.
AI reading of receipts and statements is optional. Anything with people’s personal details is only sent to Google’s paid Gemini service, which doesn’t use it to train its models. Everything works without AI too.
Public forms have hidden spam traps, time checks and rate limits, so robots can’t flood your inbox or your sign-up lists.
Photos, documents, chat and the accounts are for members only. Only what you choose to publish appears on your website, and documents can be limited to the committee or trustees.
Santa letters go on the date you set, stallholders’ insurance certificates six months after the event, unconfirmed newsletter sign-ups after 30 days, and chat after the period you choose.
Doing things properly
PTAs have to follow the same laws as any other charity. PTA Central is designed to make the right way the easy way.
Your PTA is the data controller; we’re your data processor, with a data processing agreement under Article 28. You can search a person’s details by email to answer a request, export your mailing list, and delete people’s details. Retention rules are built in: unconfirmed newsletter sign-ups go after 30 days, insurance certificates six months after an event, and chat after the period you choose.
Read the data processing agreementNewsletter sign-ups are confirmed by email (double opt-in), so only people who asked get your newsletter, and every newsletter has a one-click unsubscribe. There are no tracking cookies, so there’s no cookie banner.
Our cookiesYear-end receipts and payments accounts and a statement of assets and liabilities follow the Charity Commission’s CC16 layout. The examiner pack is ready for independent examination, and payments need approving by someone other than the person asking, and by two people above your limit.
The money featuresGift Aid declarations use HMRC’s model wording and are kept for as long as HMRC requires. Only donations covered by a declaration go on your claim schedule, which is ready for HMRC’s Charities Online service.
Gift Aid in PTA CentralRaffles in England, Scotland and Wales: PTA Central helps you choose between an incidental lottery at an event and a small society lottery, checks the legal limits, reminds you to register with your council and prepares the return. Every draw is fair and recorded.
Raffles and auctionsWe aim for WCAG 2.2 AA across PTA Central, including the website we give your PTA: it works with a keyboard and screen readers, with clear text and good contrast.
Our accessibility statementSanta letters ask for first names only, never surnames, addresses or dates of birth. Children’s details are encrypted, seen only by your elves, every look is recorded, and they’re deleted on the date you set.
Santa lettersPTA Central gives you the tools; your committee still decides how to use them. We’re not lawyers, and nothing here is legal advice.
If we find a security problem that affects your PTA’s data, we’ll tell your PTA without undue delay, with what we know, so you can decide whether to tell the Information Commissioner’s Office (within 72 hours) and the people affected. We’ll help you with both.
Inside PTA Central, your super admin can sign everyone out of every device at once, and the audit log shows who looked at what.
Report a security issue
Found a security problem in PTA Central? Please tell us at hello@ptacentral.co.uk. We’ll reply quickly and keep you updated while we fix it.
No made-up badges
We only claim what PTA Central actually does. We don’t claim certificates or approvals we don’t have.
Start your free 30-day trial, or ask us anything about how PTA Central handles your data.
