A private, safe space for the people your organisation supports to plan their way out of debt.
DebtRiot gives councils, housing associations, employers and support organisations a white-labelled tool, designed for the people they support to see their whole picture, check honestly whether a repayment plan can work, and reach free debt advice in one tap. If a plan can work, they choose their own strategy and keep it on track, day by day, with a check-in every month. There is no login. No names, emails or financial figures are collected, and plan figures stay on the person's own device. You get anonymous aggregate insight, never individual data.
Built for organisations that care about confidentiality
Debt still carries stigma. Many people check their situation privately before they tell anyone, and being asked to create an account can be enough to put them off. DebtRiot removes that step.
People plan in the browser. No account, no login, and no names, emails or financial figures collected. Their plan stays on their own device, not with DebtRiot. An Exit this page button and a directory of genuine, free help are on every screen. Your organisation never becomes a processor of your tenants' or employees' financial data.
You receive anonymous, aggregate insight only: usage patterns, completion journeys, strategy choices and the most common debt types, counted and never linked to a person. Insight for your reporting, without individual exposure.
Four steps. No data touches your servers.
People plan privately. You see only aggregate, anonymous insight.
You share a white-labelled link
Your organisation gets a unique URL, for example app.debtriot.co.uk/yourassociation. You share it in your welcome pack, financial wellbeing communications or tenancy support materials. No IT work required.
People plan privately in their browser
No account, no login, and no name, email or National Insurance number ever asked for. The person sees their whole picture, priority debts first, and checks honestly whether a plan can work. If it can't, free debt advice comes first. If it can, they compare five strategies and choose their own. Free help is on every screen.
Aggregate insight reaches your dashboard
Anonymous, aggregate metrics only: usage patterns, completion journeys, strategy choices, charity signposting effectiveness and the most common debt types. Auto-generated monthly and annual reports for your own outcome reporting. No individual data. Ever.
People keep their own plan, and keep it on track
The plan is saved on the person's own device and generated entirely in the browser, never sent to or stored by DebtRiot. They see the months ahead, track what goes out day by day, and update the plan at a monthly check-in. The person owns their plan. You never see it.
Built for UK organisations. Different by design.
Not adapted from a US product. Not a generic financial wellness platform. Built for the UK, from the ground up.
Four sectors. One product.
Housing Associations
Tenants in arrears, or worried they soon will be, get a private first step: their whole picture with rent arrears treated as a priority, an honest check on whether a plan can work, and free advice one tap away. It works between conversations with your income team or a money adviser, without putting your organisation in scope for personal financial data.
- Share via welcome packs or tenancy support communications
- Procurement documents ready: DPA, DPIA, security overview, accessibility statement
- No IT integration required
- DPA included as standard
Councils and support organisations
Residents behind on council tax, rent or energy often have other debts too. DebtRiot puts every debt in one place, priority debts first, and gives people who can't make a plan work a Standard Financial Statement ready for a free adviser, so advice teams start from the figures, not a blank page.
- Share on your website, in letters or through advice and support teams
- Priority debts, including council tax, paid first in every strategy
- Standard Financial Statement for free debt advice
- Anonymous insight for your own outcome reporting
EAP Providers
Money worries often sit behind the other problems people bring to an EAP. DebtRiot gives your clients' employees something they can act on straight away, privately, without disclosing anything to their employer, with free debt advice one tap away when they need more.
- White-labelled link per client employer
- Aggregate insight only - employer sees no individual data
- No personal data stored
- Complements existing coaching or counselling referral
Employers
Financial wellbeing is now a mainstream employer concern, but many wellbeing platforms ask employees to create accounts and hand over sensitive data. DebtRiot provides a private space to plan without the data risk or the account barrier.
- Share via intranet, Slack, or wellbeing comms
- Employees never identified - complete privacy
- HR and payroll teams see only aggregate insight
- Reduced data incident exposure for the employer
Working with independent professionals rather than deploying site-wide? See DebtRiot for Professionals.
What we collect. What we don't. Who sees what.
This section is for data protection officers, procurement leads and IT teams who need to understand exactly what happens to data when the people you support use DebtRiot.
The short answer: DebtRiot stores nothing that identifies an individual. All debt figures, strategy choices and repayment calculations stay in the person's browser. If they choose to keep their plan, it is saved on their own device, never on DebtRiot's servers. The PDF is generated locally and is never transmitted. The only exception is the connection IP address, used for rate limiting only: it is held as a one-way hashed tag for up to 15 minutes, the raw address is never stored, and it is never linked to anyone's usage.
What DebtRiot stores are anonymous aggregate counts: event counters per organisation per month, recording usage patterns, strategy choices, completion journeys, the most common debt types, debt size in broad bands, and charity signposting. No individual identifiers, no exact figures, no demographics. Small counts are rounded or held back so a result cannot point to one person. The counts are stored in a UK-hosted cloud database (Upstash Redis, London, UK) and retained long-term to enable 6-month trend analysis and your own outcome reporting.
A UK GDPR Article 28 Data Processing Agreement is included as standard with every Discovery period and every licence. Your DPO does not need to draft one; it is provided at the point of signature.
ICO registration: ZC267106 · DebtRiot Ltd, registered in Wales, company no. 17499198
| Data point | Collected? | Where stored | Who sees it | Retained |
|---|---|---|---|---|
| End users | ||||
| Name | Not collected | Not applicable | Nobody | Not applicable |
| Email address | Not collected | Not applicable | Nobody | Not applicable |
| Income, spending and debt figures | Not collected | User's browser; on the user's own device if they keep their plan | User only | Cleared at session end, unless the user keeps their plan |
| PDF and plan content | Not collected | User's device only, generated in the browser | User only | Kept by the user if downloaded; never sent to DebtRiot |
| IP address | Transient, rate-limiting only | One-way hashed tag; raw IP never stored or logged | Nobody | Up to 15 minutes |
| Demographics | Not collected | Not applicable | Nobody | Not applicable |
| Anonymous aggregate insight | ||||
| Session events | Aggregate counts only | Upstash Redis, London, UK | Your org admin + DebtRiot | Long-term (trend analysis) |
| Strategy choices | Aggregate counts only | Upstash Redis, London, UK | Your org admin + DebtRiot | Long-term (trend analysis) |
| Completion funnel and check-ins | Aggregate counts only | Upstash Redis, London, UK | Your org admin + DebtRiot | Long-term (trend analysis) |
| Debt types | Aggregate counts only, small counts held back | Upstash Redis, London, UK | Your org admin + DebtRiot | Long-term (trend analysis) |
| Total owed | One of five broad bands, counted; no exact amount | Upstash Redis, London, UK | Your org admin + DebtRiot | Long-term (trend analysis) |
| What-if amount | One of four broad bands, counted; no exact amount | Upstash Redis, London, UK | Your org admin + DebtRiot | Long-term (trend analysis) |
| Optional short survey | Fixed-choice answers, counted; no free text | Upstash Redis, London, UK | Your org admin + DebtRiot | Long-term (trend analysis) |
| Charity click events | Aggregate counts only | Upstash Redis, London, UK | Your org admin + DebtRiot | Long-term (trend analysis) |
| Org admins | ||||
| Recovery contact (email or phone) | Collected | UK (London) | DebtRiot only | Deleted within 30 days of contract end, or 5 business days after a written request |
| Admin access code | One-way hash only | UK (London) | Nobody, not even DebtRiot | Deleted with the admin account |
Discovery period before annual contract.
Pricing is based on organisation size. DebtRiot doesn't offer free pilots: without commitment, integration suffers on both sides. Instead, every organisation starts with a 3-month paid Discovery period with a clear exit clause.
Questions we hear from procurement and DPO teams
-
No. We provision a white-labelled URL for your organisation - for example, app.debtriot.co.uk/yourassociation.Your team shares that link however you normally communicate with tenants or employees: email, welcome packs, intranet, Slack. There is no software to install, no integration with your systems, and no API connection required. Your IT team does not need to be involved at any point.
-
DebtRiot collects no personal data from end users. Debt figures, strategy choices, and repayment calculations exist only in the user's browser session — they are never transmitted to our servers. The PDF plan is generated on the user's device. What we store are anonymous aggregate counts — event counters per organisation per month, recording usage patterns and strategy choices. None of this can be traced to an individual. A UK GDPR Article 28 Data Processing Agreement is included with every subscription. ICO registration number: ZC115123.
-
No. DebtRiot is a calculation and planning tool — it presents mathematical comparisons of different repayment strategies based on numbers the user enters. It does not recommend specific products, advise users to take on credit, or make any regulated financial recommendation. It is comparable to a mortgage calculator — a tool that helps someone understand their options, not advice telling them what to do. Your organisation does not require FCA authorisation to offer access to a debt calculation tool.
-
Yes, and to WCAG 2.2 AA, which is one level above the 2.1 AA baseline. Accessibility was a requirement from day one: semantic HTML, keyboard navigation, screen reader compatibility, and verified colour contrast, pinned by automated tests. Our accessibility statement is published at debtriot.co.uk/legal-organisations, including known limitations and our ongoing improvement programme. If your organisation has specific accessibility requirements, include them in your Discovery enquiry.
-
No. The Discovery period is 3 months and includes full access to all features. There's no automatic renewal — at the end of Discovery, we hold a review meeting and you decide whether to proceed to annual contract. If not, the link is decommissioned and your admin dashboard is closed. No invoice, no chaser, no rollover. If you decide to continue, the annual contract begins month 4 with terms agreed at the review meeting.
-
Yes. We apply your organisation's name, logo and brand colour to the platform - the gate page, the completion page and the dashboard - and to your organisation-led statistical reports. The end-user experience feels native to your organisation, at app.debtriot.co.uk/yourassociation.
End-user PDF and spreadsheet exports carry a "Powered by DebtRiot®" wordmark and do not embed your logo. That is deliberate: the export is the user's own document, and the wordmark is what makes it recognisable to a creditor as a neutral calculation rather than something you produced about them.
If you have specific branding requirements, include them in your Discovery enquiry.
-
Yes — a DPA is required under UK GDPR Article 28 whenever a controller engages a processor. Because DebtRiot processes only anonymous aggregate data (no personal data), the practical data risk during Discovery is near-zero. We provide a standard DPA at the point of contract signing. It's a short document — plain English, no legal negotiations required. If your DPO has specific requirements, we are happy to discuss amendments before signing.
Ready to offer the people you support a private, safe space to plan their way out of debt?
Discovery takes 48 hours to set up after signing and needs no IT work on your side. If you have questions first, email hello@debtriot.co.uk for a reply within one working day.
DebtRiot is operated by DebtRiot Ltd, registered in Wales, company no. 17499198. ICO registration: ZC267106. Professionally insured. UK registered trade mark no. UK00004368441, Class 42.