Names, contact details, employment history, donations, sometimes health or accessibility notes — held for decades, about people who did not choose to be marketed to. Metrolo was built with those obligations in the foundations rather than added when a customer's legal team asked.
Metrolo is single-tenant. There is no shared members table with a tenant column, no query that could return another organisation's records if a filter were forgotten, and no noisy-neighbour risk. Your deployment can sit in whichever jurisdiction your legal team prefers.
Permission checks live in the API, not in the interface. Hiding a button is presentation; refusing the request is security. Every endpoint re-checks the grant, and the ownership fallback is applied in the same place rather than being reimplemented per screen.
Authentication uses HttpOnly, Secure, SameSite cookies. There is no access token in localStorage for a cross-site script to lift, and the browser never holds a credential JavaScript can read.
Each profile field carries its own tier — public, members-only, private or hidden — chosen by the member. The tier is applied when the record is loaded, so a hidden field is absent from the response rather than merely absent from the page.
Files are type-sniffed on the server rather than trusted by extension, stored outside the webroot where no URL can reach them directly, and served only through short-lived signed links.
Anything a member or admin writes in a rich-text editor passes through one sanitiser with a closed allow-list before it is stored — not on the way out, and not in fifteen different places.
Each of these is something a member can exercise from their own account, or your team can action on their behalf — not a process that lives in someone's inbox.
A member requests an export from their own settings and receives an archive of everything held about them — profile, registrations, payments, posts, consents — in a machine-readable form.
A deletion request starts a 30-day window, then purges. Records that must survive for accounting or governance — a payment line, a vote count, an attendee total — are anonymised rather than orphaned, so your books still balance.
Consent is captured at sign-up against a specific policy version. Publish a new privacy policy or terms and members are asked to accept again at their next login. What they agreed to, and when, is on the record.
Every administrative action on member data is written to an append-only audit log as it happens — actor, action, record and timestamp — filterable when someone asks you to demonstrate what was done and by whom.
Members correct their own records directly. Where an administrator makes a correction on their behalf, the change is logged with the administrator's identity attached.
Email security@metrolo.io with what you found and how to reproduce it. We will acknowledge within two working days, keep you updated while we fix it, and credit you if you would like to be credited. We will not take legal action against anyone who reports in good faith and does not access data that is not theirs.
Procurement usually arrives with a spreadsheet. Send it over — we would rather answer it properly now than discover a blocker three weeks into onboarding.