Built to keep every band’s data its own.

One band can never see another

Every band on BandHQ shares infrastructure but not data. Separation is enforced by the database itself rather than by application code, so a mistake in a page or an API route cannot leak another band’s members.

• Row-level security is enabled on every table — there is no table without it.
• Policies key off the signed-in member’s own band, resolved inside the database.
• The privileged key that bypasses these rules is server-only and never reaches the browser.

People see their own band, and their own role

What each person can reach is decided in the database, not just hidden in the interface.

• A member sees their own band — its roster, events, chat and their own availability and practice.
• Admins manage the band; sensitive actions are limited to them.
• A member’s private practice log is theirs; it is not a management dashboard on individuals.

What protects our own way in

Supporting you sometimes means someone at BandHQ needs to open your account. That path is deliberately narrow and recorded.

• Administrative access to a band account is limited, and the actions we take are recorded in an audit log. Opening a page to look at something is not itself recorded — we would rather say so than let “logged” do more work than it has earned.
• Every one of our own accounts that can reach customer data requires a second factor, not only a password. It is mandatory, not optional, and that includes the break-glass accounts.

Where your data sits

Your band’s records are held in the EU and encrypted in transit and at rest, and the application that serves them runs there too. It did not always — the annex below says where it used to run.

• The database and files are in the EU (Ireland). That is where members, events, messages and attachments live.
• The application runs in the EU too. Our hosting provider defaults to Washington DC; we have pinned it to Dublin, the same region as the database, so a request is served beside the data it reads rather than across the Atlantic from it.
• All traffic is over TLS; the database is encrypted at rest.
• Private files (e.g. attachments) are served through short-lived signed links, checked against the reader’s access each time.

You can take it with you, and delete it when you leave

Two rights that only mean something if the app itself does the work: your data is exportable and your account is deletable, without asking us and without a form.

• Export. Every signed-in member can download their own data as a machine- readable file — profile, contact details, availability history, practice log, messages and reactions. The route is /account/export.
• Delete.Delete your account from within the app itself, on any device. Your personal data is erased across every band you were in; your messages and posts stay in the band’s history so its conversations aren’t torn up, but your name comes off them.
• The one guardrail. Deletion is refused when removing you would leave a band with no administrators, so a band is never silently orphaned. Appoint another admin first.

The services we rely on

We share personal data only with the providers that make BandHQ work, each under a contract limiting them to acting on our instructions. We do not sell personal data.

This list was last changed on 1 September 2026. Our Data Processing Agreement commits us to telling bands when we add or replace a provider, and this is the page that shows the current set.