Trust Center

🌎 Data Residency

• ✓ Case data and documents are stored in Microsoft Azure West Europe (Netherlands), with a second copy of documents in North Europe (Ireland)
• ✓ AI processing runs in Azure Sweden Central
• ✓ A few supporting services work outside the EU under Standard Contractual Clauses or the EU-US Data Privacy Framework: Microsoft Graph (your users' names and emails, for invitations), Google reCAPTCHA (browser signals from people using your request forms) and Stripe (billing). None of them receive case content or documents.
• ✓ Irish registered company (EU jurisdiction)

🔒 Encryption

• ✓ AES-256 encryption at rest
• ✓ TLS 1.2 or higher in transit (TLS 1.3 where your browser supports it)
• ✓ Encrypted database backups
• ✓ Data encrypted with Microsoft-managed AES-256 keys; application secrets kept in Azure Key Vault

👥 Access Controls

• ✓ Role-based access control (RBAC)
• ✓ Single sign-on (SSO) via Microsoft & Google: your users sign in with their existing Microsoft 365 or Google account. A one-time email code is also available.
• ✓ Session management & timeout
• ✓ Every action is recorded in an audit log. No user can edit or delete entries.

✅ Compliance

• ✓ GDPR-ready by design
• ✓ Data Processing Agreement (DPA) available
• ✓ Hosted on Microsoft Azure, which holds ISO 27001 and SOC 2 certifications. SAR Portal itself is not ISO 27001 or SOC 2 certified; we hold Cyber Essentials and Cyber Essentials Plus (independently audited).
• ✓ Privacy by default settings
• ✓ Regular compliance reviews

🇬🇧 Cyber Essentials Plus

SAR Portal is operated by Sekhon IT Consultants Ltd., a Cyber Essentials Plus certified organisation — the audited level of the scheme, with the five controls verified by hands-on technical testing.

• ✓ Secure configuration
• ✓ User access control
• ✓ Malware protection
• ✓ Security update management
• ✓ Firewalls
• ✓ Independently audited (hands-on technical verification)

UK Government-backed scheme delivered by IASME on behalf of NCSC. Read more →

📞 Support & Response

• ✓ We reply to support requests within one business day (Monday to Friday, 9:00 to 17:30 Irish time). Enterprise: within four business hours.
• ✓ Enterprise customers have a named contact: one of our directors.
• ✓ Security incidents prioritised immediately

☁ Infrastructure

• ✓ Microsoft Azure cloud infrastructure
• ✓ The database has continuous backup with 7-day point-in-time restore
• ✓ Documents stored geo-redundantly (Netherlands and Ireland)
• ✓ Every uploaded file is scanned for malware by Microsoft Defender for Storage
• ✓ Enterprise contracts include a 99.5% monthly uptime commitment; on other plans 99.5% is our target, not a guarantee.