Custody you can evidence. Records that cannot be quietly changed.

• Licensed sites onlyFirearms are held only at licensed custody sites: dealers whose dealer licence, which specifies the safe or strongroom, is recorded with its expiry date. A site with a lapsed credential cannot be allocated new work.
• Receipted on arrivalEach firearm is verified against the pre-advice, photographed, given an asset tag and receipted. Anything that does not match becomes an exception with a reasoned outcome, never a quiet edit.
• Every movement recordedDelivery into custody, relocations within a site and releases are custody events with a named person and a time. Internal storage positions stay on the custody site's own screens; firms see the custody region, and the depositor sees the custody partner's trading name and premises address on the portal.
• Release under dual controlA release needs the executor's signed instruction, a completed checklist, identity confirmed at retrieval and a second person's approval. Payment status never triggers release or disposal.
• Independent stocktakesPeriodic stocktakes compare the physical count with the expected count fixed at the start; discrepancies go to a reviewer who was not the counter.
• Regulated steps default to noReceipt into dealer custody and any disposal proceed only under the current legal position, recorded with its legal source and approved by two people. If a later order changes it, the affected matters pause and the firms concerned are told.

• Matter records cannot be edited or deleted in placeFirearms, custody events, financial records, the history of legal rules and audit events cannot be edited or deleted in place. Corrections are added with a reason, never overwritten. The exceptions come at the end of the retention periods: audited database routines remove the personal details and destroy the files the privacy notice names, and nothing else; short-lived technical records such as sign-in attempts are deleted routinely.
• Every material change is auditedWho, what, when, the record concerned and a before-and-after summary are recorded together with the change itself.
• Administrators cannot edit historyDatabase rules enforce the audit trail, so no administrator can rewrite it through the application.
• A closure pack for the fileReceipts, photographs, the valuation, the signed instruction, the evidence of the sale or transfer and the settlement statement are filed together when the matter closes.

• Each firm sees only its own mattersAccess is checked on the server for the firm and the matter; a firm cannot open another firm's matter by guessing an identifier.
• Two-factor verificationRequired for administrative, finance, compliance and custody-management roles, with step-up verification for actions that need two people. Executors sign in by secure link and one-time code.
• Malware scanning before viewingEvery uploaded document and photograph is scanned; nothing can be opened until it is recorded as clean.
• Signed, expiring document linksDocuments are served through signed links that expire within minutes; document storage is private.
• Nothing sensitive by emailNotifications are rendered from templates that reject serial numbers, identity numbers and document content.
• Encrypted in transitTraffic to the site and the portal is encrypted with TLS, and outgoing email is sent over TLS.
• Documents encrypted at restUploaded documents, photographs and generated documents are stored encrypted (AES-256). Identity numbers and sign-in secrets are sealed in the database.

• Hosted in Helsinki, FinlandThe portal, its database, document storage and email run on a server operated by Hetzner Online GmbH, which is subject to the EU General Data Protection Regulation.
• Backed up every nightAn encrypted copy of the database and documents goes to separate Hetzner storage in Germany each night, and nothing is kept on the server itself. A restore from it was tested on 2 October 2026.
• Kept, then personal details removedMatter records, custody events, invoices and the audit trail are kept for at least five years after a matter closes, ten where it had exceptions, waivers or a legal hold, and eight after its last financial record. Then, once two of our people approve, the personal details of the living people on it are removed and the records stay. Signed documents are kept unaltered for ten years after the last custody event, or ten years after closure where no firearm entered custody, and are then destroyed.

The cross-border basis is set out in section 6 of the privacy notice.