Secure driver National Insurance and bank details

This guide explains how sensitive driver values are retained. The guide then takes you through the correct route, the checks to complete before making changes, the workflow in order, and the evidence to review afterwards.

What you’ll accomplish

Understand how sensitive driver values are retained. The instructions below follow the supplied module’s controller, form and model rules, including server-side validation and downstream effects.

Follow these steps

1. Enter sensitive values only from an authorised source.
2. Save the driver.
3. Restrict access through staff roles.
4. Use the application record rather than copying values into general notes.

Fields and options to review

This action uses the values already stored on the selected source record. Review that record before continuing.

Rules the system enforces

• National Insurance and bank details are encrypted before storage.
• Secrets and sensitive values should not be exposed in audit or notification text.

How to confirm it worked

• The source record, status/history and any downstream notification, provider, POD or finance record should agree after the action.

Security, audit and operational checks

• Use the exact record and least-privilege role before changing any state.
• Verify the saved record after every action; a browser message alone is not evidence that every downstream step completed.
• Use protected document and image routes rather than exposing server filesystem paths.
• Keep customer, driver, provider, financial and credential data within the authorised workflow.
• For provider, finance, employment, transport and compliance decisions, follow the organisation’s authorised professional process.

Continue with related guidance