Trust Center: Certificates, Data Location and Controls
Data location and transfers
Data location depends on your data classes, your sector and the rules that apply to you. We record the choice for each workload, so your reviewers can see the reasoning rather than a general statement.
- Residency choice. We decide the region for data at rest with you, workload by workload. No hyperscale cloud region is located in Bangladesh, where we also run engineering. Our AWS working set is Mumbai and Singapore, so data sits in those regions unless a different region is agreed in writing.
- Transfer documentation. Cross-border transfers and processing terms are written into the contract, as applicable in your jurisdiction. We do not assume a transfer mechanism is in place. Your counsel confirms what applies to you.
Security posture
Our controls and certificates fall into three groups. Keep them separate in your assessment: certificates are audited, and readiness is what we build toward.
- ISO certificates. ISO/IEC 27001:2022 (information security, certificate 25/18024, expires 6 October 2028) and ISO 9001:2015 (quality management, certificate 25/182622, expires 7 October 2028). Both are issued by A Cube TIC Limited.
- SOC 2 and PCI DSS readiness. We design controls to the SOC 2 criteria and to PCI DSS requirements for cardholder-data workloads, and we document them. SOC 2 is an audit report, and PCI DSS is a payment-card standard. We hold neither as a company certificate.
- Identity and encryption. Least-privilege IAM, encryption in transit and at rest, secrets management, and continuous monitoring, with controls documented for your auditors.
Frequently asked questions
Where can our data be stored?
Your data classes and the rules that apply to you decide it. Some workloads need a specific region, and others work well in the nearest AWS region. We document the choice per workload, as applicable in your jurisdiction.
Do you have a third-party audit report?
We do not hold a SOC 2 report or a company PCI DSS certificate. We hold ISO/IEC 27001:2022 and ISO 9001:2015, and we will document our controls for your auditor.
Which standards do you build to?
We build to the AWS Well-Architected Framework, align our information-security controls with the ISO/IEC 27001:2022 scope, and build to SOC 2 and PCI DSS readiness. We do not claim certification where we hold none.