NoDossier

Updated 2026-10-18

Roadmap

What is built, what is being built, and what it waits on. Every item marked done names the check that proved it, because a status nobody can audit is not a status.

Items done
15 of 25
Register, route-checked
50 of 50
Tests standing behind it
188
Live at nodossier.com

The free product

Everything a UK resident needs to exercise the right to erasure themselves, with no account and nothing stored.

  1. Statutory deadline engine

    Done

    22 tests, including both of the ICO's own worked examples and a two-year sweep proving no due date lands on a weekend or bank holiday

  2. Erasure requests worded for the ground each broker relies on

    Done

    17 tests: legitimate interests gets the Article 21(1) objection, direct marketing gets the absolute 21(2), consent gets 17(1)(b)

  3. Request builder that runs entirely in your browser

    Done

    Driven end to end in a browser: 25 letters generated from one form, none of it sent to a server

  4. Deadline tracker with the ICO complaint ready when a deadline is missed

    Done

    13 storage tests; a case past its deadline produced a complaint reading 67 days overdue, naming the ICO and predicting nothing

  5. Exposure check that refuses to pretend it is a scan

    Done

    9 tests; only verified routes are ever shown, and the count held back is stated on the page

  6. A public way to check our main promise yourself

    Done

    A /proof page teaches anyone to verify it in their own browser; a test fails the build if any tool file gains a network call, proven by injecting one; and a real browser run sent 0 requests while 25 letters were written

  7. Pricing, security, privacy and terms, each saying what is not finished

    Done

    All live; the paid tier is marked not on sale and the five outstanding compliance items are listed in public

The register

The public, checked list of who holds data about people in the UK. The one asset that gets better every time somebody uses it.

  1. Register schema that refuses to call an entry verified without a dated check

    Done

    Integrity tests; bot-blocked routes are counted separately in public rather than folded into the headline

  2. First genuinely UK brokers, including a direct marketing suppression route

    Done

    192.com, Experian Marketing Services UK, Endole, OpenCorporates and Thomson Local, each checked on the date shown in the register

  3. One page per broker: how to remove your data from each

    Done

    25 pages with FAQ and breadcrumb structured data; sitemap dated from each broker's real check date

  4. Register to 50 verified brokers

    Done

    50 of 50 route-checked on 2026-10-18, 27 of them with UK reach. Found by a harvester that reads each broker's own site rather than guessing URLs, then re-probed in one pass. Entries with no UK or EU reach on their own policy were left out, not padded in

  5. Read the privacy policies a fetch could not, to sharpen the legal ground per broker

    In progress

    →21 entries say the basis is not stated rather than guessing. Their letters use the general Article 17 wording until a person reads the policy

  6. Self-search links, so you can look yourself up on each broker's own site

    Next

    →Closes most of the gap to a competitor's scan without scraping anything

Under the surface

The plumbing a done-for-you service needs, built and tested before any of it is switched on.

  1. Encrypted data spine with nowhere to put an identity document

    Done

    Field-level AES-256-GCM plus a keyed index; 19 tests run against real Postgres in-process

  2. Case state machine that refuses illegal transitions and rolls them back

    Done

    19 tests including an exhaustive state-by-action sweep; an illegal move leaves every table untouched, verified against real Postgres

  3. A clock that runs with nobody logged in

    Done

    A request sent and ignored chases itself, goes overdue, and produces an ICO complaint pack, driven on a fake calendar

  4. Reply reader that sends anything ambiguous to a person

    Done

    16 tests; it will not upgrade a promise to delete into a completed erasure

  5. Traffic measurement, so the register's reach can be seen

    Next

    →Code shipped, cookieless, with no npm dependency. Kept off the tools by two tested layers, including after a click-through. Waits on switching it on at the host

  6. Sending and receiving mail from our own domain

    Planned

    →Waits on a sending subdomain with SPF, DKIM and DMARC, and a real inbox

  7. Review queue for replies the reader would not guess at

    Planned

    →Waits on the mail rail: there are no replies to review until requests can be sent

Acting on your behalf

The paid tier. Not on sale until the compliance work behind it is finished, and this page will say when it is.

  1. Registration as a data controller, impact assessment, retention policy, processor agreements

    Planned

    →The gate for everything below. Listed in public on the security page

  2. Accounts and a signed mandate to act for you

    Planned

    →Waits on the compliance gate

  3. Payment, seats and cancellation that erases your data

    Planned

    →Waits on the compliance gate

  4. Quarterly report built only from what actually happened

    Planned

    →Waits on the mail rail and accounts

  5. Re-checks after erasure, because brokers re-ingest

    Planned

    →Logic built and tested; waits on the exposure lookup to run against

This page is generated from the same file the build reads, and a test fails the build if its numbers stop matching the register. It will be wrong sometimes. It will not be quietly wrong.