Where our data actually sits
| What | Where | Notes |
|---|---|---|
| Application | AWS London, eu-west-2 | ECS rolling deployments with automated rollback |
| Databases | AWS London, eu-west-2 | One database per tenant, selected from the sign-in hostname |
| Uploaded files | AWS London, eu-west-2 | Documents, labels and imported invoice files |
| Disaster-recovery snapshots | AWS Ireland, eu-west-1 | Encrypted database snapshots only, inside the EEA |
| Connected marketplaces, carriers, accounting | Their own regions | Governed by their terms, not ours — ask each provider |
We do not describe this as “100% UK hosted” or “UK-only”, because the DR copy leaves the UK by design and because any platform that connects Amazon, eBay, TikTok Shop, Temu or a carrier API sends order and address data to that provider. A vendor claiming end-to-end UK-only processing while offering those integrations is describing something that does not exist.
Why the backups are in Ireland
A backup in the same region as the primary is not disaster recovery; it is a second copy of the same risk. Ireland is the nearest AWS region outside the UK, it sits inside the EEA, and the UK has an adequacy decision covering transfers there, so no additional transfer mechanism is needed. The snapshots are encrypted at rest and contain database content only.
The alternative — keeping every copy in eu-west-2 — would let a single regional incident take your operational history with it. We consider that a worse outcome than a documented EEA transfer, and we would rather show you the reasoning than hide the region.
What UK GDPR actually requires
Not a UK server. UK GDPR requires a lawful basis for the processing, appropriate technical and organisational security, and — where personal data leaves the UK — a valid transfer route. Adequacy regulations, the International Data Transfer Agreement and the UK Addendum to the EU standard contractual clauses are all valid routes. “It must stay in the UK” is a procurement preference, and a reasonable one, but it is not the statutory test.
The requirement that does bite is knowing where the data goes. If a vendor cannot name its DR region and list its subprocessors, it cannot help you complete your own record of processing activities, and that is your obligation rather than theirs.
Five questions to ask any vendor
- Which region hosts the application and the production database?
- Which region holds backups and DR copies, and are they encrypted?
- Can I have the current subprocessor list with each entry's location, and the date it was last reviewed?
- Who at your company can access my data for support, under what controls, and is that access logged?
- How is one customer's data separated from another's — shared schema with a tenant column, or separate databases?
Our answers to all five are on the security page, and the processing detail is in the privacy notice. Question five matters more than people expect: we use a separate database per tenant, selected from the hostname you sign in on, so a query in one tenant's session cannot reach another tenant's records.
Deployment and change control
Releases go out as ECS rolling deployments with automated rollback on failed health checks. We do not call this blue-green, because it is not — there is no second idle environment holding a full copy of production. The practical effect for you is that a bad release is withdrawn automatically rather than manually, and that database migrations are applied as a controlled step rather than as a side effect of a deploy.
If your evaluation includes a data-protection review, see also how to choose inventory software for the operational half of the same decision.
Hosting architecture as reviewed on 23 August 2026. This page describes our arrangements and is not legal advice; consult your own adviser on your UK GDPR obligations.