Security & trust
The plain answers your IT, legal and procurement teams will ask for - and the pack that answers the rest.
The application and database run on managed infrastructure in the EU (eu-west-3, Paris). Traffic is encrypted in transit and data is encrypted at rest by the platform.
The database is backed up daily on a rolling retention by the managed platform, and files in storage are covered by the same service. Restores are rehearsed against a real archive rather than assumed.
Every account belongs to one organisation and sees only that organisation's records, enforced in the database itself rather than in the screens. Roles decide what a person can do inside their own workspace.
Records that matter carry who did what and when. Support access to a customer workspace is never silent: it is logged and visible to the customer.
We use a small set of processors for hosting, payments, email and analytics. The current list is an annex to the data processing agreement and customers are told before it changes.
There is one export path and it is available from day one: download everything, as files and data, whenever you want it. Leaving does not require a support ticket.
Need it as one document? Ask for the procurement pack and we will send the current version. Contract terms are in the data processing agreement.