Legal

01Overview

• Where data lives. Customer data is hosted in the UK and the EEA. Application functions run in London, the database is in Ireland, and data transformation runs in the UK. See the Sub-processor list.
• Encryption. Data is encrypted in transit. Credentials for connected systems are encrypted before storage.
• Separation. Each customer’s data is separated from every other customer’s by access controls in the database.
• Access. Staff access to production systems and customer data is limited to those who need it, and staff are bound by confidentiality.
• Monitoring. Significant events are logged so we can detect and investigate problems.
• Recovery. Data is backed up automatically and can be restored after an incident.
• Breaches. We tell affected customers without undue delay, and where feasible within 72 hours.
• Suppliers. We bind every sub-processor to data-protection terms equivalent to ours.
• AI. We do not use Customer Data to train AI models, and we do not send personal data to an AI provider unless it is on the Sub-processor list.
• Anonymisation. Our rules for aggregated data are in the Anonymisation Standard.
• Certification. We are working towards Cyber Essentials certification.
• Evidence. Customers’ security and legal teams can ask for our audit pack under a confidentiality agreement. Contact dataprotection@cloudfox.it.