Trust & Assurance
Data Residency
Data location varies according to the contracted service, deployment configuration, customer requirements and applicable law.
01Scope
This page explains the principles AF-X uses to determine where customer data is hosted, processed, supported and transferred. It should be read with the applicable customer agreement, service documentation, Privacy Policy and Data Processing Addendum.
Contracted documentation takes precedence where it defines arrangements for a particular customer or service.
02Hosting and deployment
AF-X services may use selected cloud, infrastructure and technology providers. The production hosting region is agreed with each customer and documented in the applicable service agreement or service documentation.
Hosting arrangements can vary by product, deployment model, integration architecture and customer requirement. AF-X does not present one public location as applying automatically to every service or customer.
03Customer data location
The location of customer content and production service data is defined during solution design and contracting. Relevant factors may include the customer’s operating countries, regulatory obligations, service availability and technical architecture.
Customers with specific country or regional residency requirements should raise them before contracting so they can be evaluated and documented.
04International processing and access
Authorised support, infrastructure or technology providers may process or access limited information from another jurisdiction where necessary to deliver, secure or support the contracted service.
Where data-protection law requires a transfer mechanism, AF-X applies appropriate contractual and legal safeguards. Access does not automatically mean that production data is permanently relocated to the country from which support is provided.
05Sub-processors
AF-X may appoint sub-processors to provide hosting, infrastructure, support, communications or other service capabilities. Providers are assessed according to their role, the information involved and the systems they may access.
Relevant sub-processor information, including function and processing location where applicable, can be provided through customer documentation or the agreed assurance process. Changes are handled according to the applicable contractual terms.
06Security, backup and resilience
Primary hosting, backup, recovery and support locations may serve different purposes. These arrangements are selected according to service requirements and do not necessarily use the same region.
Technical and organisational security measures are described on the Security page. Customer-specific recovery objectives and continuity commitments are defined contractually.
07Customer and regulatory requirements
AF-X can evaluate requirements relating to:
- EEA or country-specific data residency
- Cross-border transfers and remote support access
- Sector or customer-specific regulatory obligations
- Data localisation and segregation
- Sub-processor transparency
- Customer-specific processing and deletion requirements
08Contractual assurance
Final hosting, processing, transfer, retention and deletion arrangements are documented in the applicable customer agreement, service documentation or Data Processing Addendum.
Enterprise customers may request relevant architecture, security and sub-processor information subject to confidentiality and the agreed procurement process.
09Questions
Residency requirements should be discussed during solution design and before contractual commitments are finalised.
Privacy and transfer questions may be sent to DPO@thegatewaycorp.com.
Bring your data residency questions to a working session.
Book a demo and bring your data location and regulatory requirements. We will cover them in the session.
