Where it lives, who can reach it, and what happens when something breaks.
The answers below are the ones procurement asks for in writing. We would rather you read them here than extract them over six weeks.
Where the data lives
Managed Postgres and container workloads, in a region named in the contract. Object storage and CDN sit behind the same boundary. Every environment is separated at the database level, not by a flag in the application.
Who can reach it
Every request carries a verified identity, and every query is scoped to that identity. A forged reference to another organisation's record matches zero rows and returns a not-found, rather than someone else's data. Each service runs under its own least-privilege account; credentials live in a managed secret store and never in code.
What is written down
Consequential actions leave a trail: who asked, what was asked for, which gate allowed it, and what came back. Built for the audit that happens two years later, when nobody remembers the week in question.
Who else touches it
A named sub-processor list, maintained rather than written once: cloud and database hosting, edge and storage, message delivery, and the model provider behind the AI layer. Supplied in full on request, with notice before it changes.
Who owns it
You own your data and the system built for you. Exit terms are written at the start, not negotiated at the end: a full export in an open format, the source, and the runbook to operate it without us.
When something fails
It fails loudly. We do not substitute a default value for a call that did not succeed, anywhere in the estate. A payment that did not go through never renders as one that did. This is an engineering rule we hold ourselves to, because a system that hides its failures is worse than one that stops.
- Capability statementPDF
- Sub-processor listPDF
- Data processing termsPDF
- Architecture overviewPDF
- Incident and support termsPDF
- Reference contactsOn request
Bring the objections. A technical review puts your engineers and ours on the architecture, the data boundary and the integration surface, before anything is scoped.