UK GDPR registered with the Information Commissioner's Office (ICO)

• All customer data hosted in the UK, on AWS in the London region

• Encryption in transit and at rest.

• Least-privilege access: Production access is limited to authorised engineers with multi-factor authentication.

• Audit logging: Activity is recorded in a tamper-evident, cryptographically signed audit trail.

Information security statement and sub-processor list shareable upon request via security@obquan.com