Data Protection |
Additional Information

Data storage

To address any concerns around data being stored on servers outside the UK:

  • Our database hosting is in Belgium (with MongoDB Atlas). The UK government has formally recognised that Belgium (as part of the EEA) has an adequate level of data protection. Under the Adequacy Decision, the UK government recognises Belgium as a safe and approved location for UK citizen data. Legally, transferring personal data from the UK to Belgium is treated exactly the same as moving it within the UK.
  • MongoDB Atlas (Belgium) adheres to higher physical security standards, and maintains the following certifications (which dictate specific requirements for encryption standards for data at rest): ISO 27001:2022 (Information Security), and SOC 2 Type II.
  • We do not have other locations for database hosting.

Data transfer/sharing:

To address any concerns around data transfer:

  • We use Firebase Authentication (provided by Google) as part of our architecture or user identity/login. Firebase Authentication currently processes and stores identity data (emails, passwords, phone numbers) in the United States by default. Regionalisation for Europe hasn't been finalised, so as it stands, this data is leaving the UK.
  • However, under the UK-US Data Bridge transfers of personal data to Google in the US are now considered adequate under UK law as Google (and by extension Firebase Auth) is a self-certified participant in the Data Privacy Framework Programme.
  • Google Cloud Platform maintains the following certifications: ISO 27001, ISO 27017 (Cloud Security), ISO 27018 (Privacy), and SOC 1/2/3.

Sub-Processors:

Aside from MongoDB Atlas, all our sub-processors are US-based and the majority are participants of the Data Privacy Framework Programme (under the UK-US Data Bridge). List of all sub-processors:

  • MongoDB Atlas (based in Belgium, see further detail in the 'Data storage' section above)
  • Firebase/Google (US based and a participant of the Data Privacy Framework Programme)
  • Sentry (US based and a participant of the Data Privacy Framework Programme)
  • SendGrid (Twilio) (US based and a participant of the Data Privacy Framework Programme)
  • OpenAI (US based and a participant of the Data Privacy Framework Programme)
  • Cloudflare (US based and a participant of the Data Privacy Framework Programme)
  • SwarmCDN (US based)

The various Data Protection Agreements, which are incorporated in the terms of service we have with each of our sub-processors, all support UK GDPR compliance by incorporating Standard Contractual Clauses (SCCs).