Public sector supplier assurance and contract pricing
Everything a UK procurement officer or DPO needs to open a supplier file on RedactProof - identity, certifications, insurance, data protection posture, and retention - on one page. Contract and invoice pricing is here too, and applies to any organisation buying on a purchase order, public sector or not.
Buying on invoice or purchase order
RedactProof can be bought two ways: self-serve online, or on contract against a purchase order - a signed order form, invoicing on credit terms, and the assurance paperwork listed below. Both are priced here, so you can budget before you ever speak to us.
| Seats | Self-serve online | Contract / invoice |
|---|---|---|
| 1-2 | £790 per seat / year | £875 per seat / year |
| 3-9 | £690 per seat / year | £765 per seat / year |
| 10-24 | £630 per seat / year | £700 per seat / year |
| 25-49 | £590 per seat / year | £655 per seat / year |
| 50-99 | £550 per seat / year | £610 per seat / year |
Every seat is the full Pro feature set - verification certificates, audit trail, and team administration from two seats. The Core individual licence (£190 per year, single user) is available self-serve only. Prices exclude VAT; Popsall Ltd is not currently VAT registered, so no VAT is charged.
What a contract order includes
- Resellers and distributors
- We supply through the channel. If you have an incumbent reseller or distributor, we can quote them directly - send us their details.
- Setup and onboarding
- Provisioning, team policy configuration, exemption codes and exclusion list seeded for your workflow, and a 45-minute remote session with your nominated lead. Included on orders of 10 seats or more; £600 one-off below that.
- Priority phone support
- Contract customers get a direct telephone line in addition to email, with a callback within 4 business hours. Anything blocking an export is handled the same business day.
- Paperwork
- One order form covers seats, term and price - no master agreement. Accept electronically, or we will countersign if your process needs a signature. Signed DPA (UK GDPR Article 28) and attestation pack available for your file.
- Payment terms
- Billed annually in advance. Contract orders are invoiced and settled by BACS transfer; online orders are paid by card. Payment terms are agreed on the order form.
- Multi-year
- Prices can be held for up to three years, billed annually, with a discount for the commitment.
- Quotes for procurement & resellers
- Send us your seat count - or your reseller's details - and we'll come back with a written quote.
Supplier identity
- Trading name
- RedactProof
- Legal entity
- Popsall Ltd
- Company number
- 16953262 (England & Wales) - view on Companies House
- Registered office
- 3rd Floor, 86-90 Paul Street, London EC2A 4NE, United Kingdom
- Business size
- Micro-business / SME
- VAT status
- Not VAT registered
- Central Digital Platform
- Registered - organisation identifier PMRG-9735-ZYXZ
- Contact
- support@redactproof.com
- Telephone
- 020 3951 4404
Certifications and registrations
RedactProof (operated by Popsall Ltd) is Cyber Essentials certified - the UK government-backed baseline security scheme run by the NCSC and IASME - with whole-organisation scope. Certified 23 July 2026, expires 23 July 2027, renewed annually. The badge is served live by the IASME/Blockmark certification registry, so it always reflects current status; you can open the certificate entry to verify it directly, or download the certificate (PDF) for your evaluation record.
We are registered with the Information Commissioner's Office - registration ZC164232, registered 2 June 2026, expires 1 June 2027, renewed annually. Verify it on the ICO register, or download the registration certificate (PDF).
Insurance
Popsall Ltd holds professional indemnity and cyber liability insurance. Evidence of cover is available on request via support@redactproof.com, and cover levels can be increased to meet specific contract requirements.
Data protection
RedactProof processes documents in the browser by default. Every export is verified before download - the application re-opens the generated file and confirms no text remains in redacted areas. The table below sets out what leaves the device under each processing mode. For the processing architecture in depth - what stays on the device, what is stored server-side and why, encryption and threat model - see the security documentation. For the data-protection position - lawful bases, sub-processors, international transfers and retention - see the privacy policy.
| Processing mode | What leaves the device |
|---|---|
| Standard Engine | Nothing. The document and any extracted text stay on the user's device. |
| Precision Engine (opt-in, Pro) | Extracted text only - never the original file - is sent to Cloudflare Workers AI for inference, processed in volatile memory only and never stored. Cloudflare does not commit to a processing region for this inference - our own data storage remains in their EU region - so we conservatively treat it as a potential transfer outside the UK/EEA - safeguarded by Standard Contractual Clauses, the UK Addendum (IDTA) and the EU-US Data Privacy Framework. On Pro, from two seats, administrators can disable the Precision Engine organisation-wide; the control is enforced server-side, not merely in the client. |
| Verification certificates | SHA-256 hashes of the original and redacted files, plus three audit fields - redaction counts by category, page count, and your chosen attribution (your email address, a user ID that is system-generated or one you set, or nothing). The document itself and its text never leave the device. |
Sub-processors
- Cloudflare - infrastructure, security, and AI-powered detection processing (Pro)
- Stripe - payment processing
- Resend - transactional email delivery
Full sub-processor and international transfer detail is in our privacy policy.
Team administration and audit
On Pro, from two seats, a nominated administrator can centrally enforce policy across all seats - including locking export and attribution settings and disabling the opt-in Precision Engine organisation-wide (enforced server-side). Every policy change is recorded in an audit trail with the before and after values, the acting administrator, and a timestamp.
For separation of duties, members can be set to approval required: they prepare and submit redaction work, and a second person reviews it and exports under their own name (maker-checker). Submissions carry only content-free work-state - never documents, text or filenames - and every submit, claim, approval and decline is audit-logged. See the approval workflow reference.
Business continuity
Supplier-failure impact: the architecture limits what a customer could lose if RedactProof ceased operating. Documents are never uploaded, so no customer document content is held that could be stranded or require return. Redacted outputs already exported are ordinary files and are unaffected. The exposure is limited to access to the hosted application and account services - there is no data-recovery or forced-migration burden at exit.
Certificate continuity: verification certificates are designed to remain useful without RedactProof. Each certificate is a signed cryptographic record (Ed25519 signature over SHA-256 document hashes), and verification requires only the certificate, the document, and our published public key - not our servers. Recipients can verify a document three ways: through the verifier on our site; through an independently hosted verifier on GitHub Pages, which operates with no dependency on RedactProof infrastructure (published public key); or manually, using standard open-source cryptographic tooling. In the event of a prolonged outage or permanent cessation of service, every certificate previously issued remains fully verifiable.
Exit and incident response
Data deletion and exit: account deletion permanently removes all server-side account data, including verification records. Because documents are never uploaded, there is no customer document content to return or delete at exit. Detail in the security documentation.
Incident response: we operate a documented incident-response procedure. Personal-data breaches are assessed against the UK GDPR 72-hour ICO notification threshold, and affected customers are notified without undue delay.
Retention summary
| Data | Retention |
|---|---|
| Account data (email, certificate hashes, certificate metadata) | Until account deletion |
| Server logs | Up to 90 days |
| Billing records | Up to 7 years (legal requirement) |
| Precision Engine extracted text | Not retained - processed in memory only |
Documents
Terms of Service
Contractual terms of use
Privacy Policy
Data processing, retention, and sub-processors
Security architecture
Full technical detail on processing and storage
Cyber Essentials certificate
Live registry entry (IASME/Blockmark)
Cyber Essentials certificate (PDF)
Dated copy for your evaluation record
ICO registration certificate (PDF)
Data protection registration ZC164232