Where your support data lives, in plain English.
UK buyers want to know where their customer data is hosted and which laws apply to it. Solves keeps customer support content encrypted at rest with per-organisation keys, served from a UK or EU cloud region, and carried over TLS. We are at pilot stage, so we describe this honestly as our current arrangement, not a certified guarantee.
Encrypted at rest, per-organisation keys · UK or EU cloud region · TLS in transit · Metadata-only logs
The short answer
Where Solves keeps your data, and why it matters
Solves hosts customer support content with a UK or EU cloud provider, in a UK or EU region. That content is encrypted at rest with a separate key for each organisation, and it travels over TLS. At pilot stage, we will not name a specific data centre or claim a certified region.
Residency matters for two reasons. Law: data held in the UK or EU sits under UK and EU data-protection law that most teams understand. Risk: keeping data close to home reduces the chance another country could compel access. Neither is solved by location alone, so we pair residency with encryption and restricted access.
Three terms often get muddled, and a procurement form may ask about any.
| Data residency | Where your data physically sits: the country or region that holds the servers. This is what most "where is my data?" enquiries are really asking. |
|---|---|
| Data localisation | A stronger rule that certain data must stay inside a given country: a requirement to keep it in place, not just a description of where it is. |
| Data sovereignty | Which laws and authorities have a claim over the data. It is subject to the laws of the country it lives in, and whoever controls it can be compelled to follow them. |
In short, residency is location, localisation is a duty to keep data in one place, and sovereignty is which legal system governs it. Solves keeps customer content in a UK or EU region, so residency and sovereignty point the same way, while encryption protects it either way.
How we handle your data
Residency, encryption and access, together
Location is only part of the answer. Here is what protects your support content.
UK or EU region
Hosted with a UK or EU cloud provider, under data-protection law UK teams understand.
Encrypted at rest
Message bodies, subjects, contact details and saved replies are encrypted with XChaCha20-Poly1305.
TLS in transit
Carried over TLS between browser, service and email provider, encrypted on the wire too.
Per-organisation keys
One tenant's content cannot be read with another's key. Keys are managed outside the database.
Metadata-only logs
Logs record timings, route families and error context, never message bodies or email addresses.
Authorised access only
Access to customer content is limited to authorised systems and people, not browsed as a matter of course.
Honest about the limits
What we will and will not claim
We would rather be precise than impressive. Hosting in a UK or EU region helps, but on its own it does not make any product "UK GDPR compliant", so we do not use that label yet. The policies and records it depends on are in preparation before public paid launch.
What we can state today
- Customer support content is hosted with a UK or EU cloud provider, in a UK or EU region.
- That content is encrypted at rest with XChaCha20-Poly1305 and a separate key per organisation.
- Data is carried over TLS in transit between browser, service and email provider.
- Access is restricted to authorised systems and people, and our logs hold metadata only.
What we will not claim
- We do not name a specific data centre or assert a certified region while at pilot stage.
- We do not claim "UK GDPR compliant", "zero-knowledge" or "enterprise-grade compliance".
- We do not invent a hosting provider name, a company number, an address or uptime figures.
The named third parties that handle data are Postmark for email delivery, Stripe for billing and the UK or EU cloud hosting provider. The sub-processors page lists what each touches.
Need a written statement for procurement?
If a procurement or due-diligence process needs the exact provider and region for your account, ask through the contact page and we will share what applies. We would rather give an accurate answer than a marketing one.
FAQ
Data residency and sovereignty questions
What is the difference between data sovereignty, data residency and data localisation?
Residency is where your data physically sits. Localisation is a stronger rule that certain data must stay inside a given country. Sovereignty means the data is subject to the laws of the country it lives in, and whoever controls it can be compelled to follow them. Solves keeps customer content in a UK or EU region, encrypted at rest, so residency and sovereignty point the same way.
What does data sovereignty mean for a UK business?
It means being clear about which legal system your customer data falls under and who could lawfully access it. Data held in the UK or EU sits under UK and EU data-protection law that most UK buyers are comfortable with. The usual concern is data held in regions where another country could compel disclosure. Solves keeps customer support content in a UK or EU region and encrypts it at rest.
Where is my Solves data hosted?
With a UK or EU cloud provider, in a UK or EU region. As we are at pilot stage, we describe this as our current arrangement rather than naming a specific data centre or claiming a certified region. If you need a written statement of the exact provider and region, ask through the contact page and we will share what applies.
Is customer data encrypted?
Yes. Customer support content (message bodies, subjects, contact details and saved replies) is encrypted at rest using XChaCha20-Poly1305 with a separate key for each organisation, so one tenant's content cannot be read with another's key. Data is also carried over TLS.
Does hosting in the UK or EU make Solves UK GDPR compliant?
On its own, no, and we do not claim that label while Solves is at pilot stage. Compliance depends on documented policies and records that we are preparing before public paid launch. We can state today where data is hosted, that content is encrypted at rest with per-organisation keys, that access is restricted, and that logs hold metadata only.
Which third parties process Solves data?
Solves uses Postmark for email delivery and Stripe for billing, and runs on a UK or EU cloud hosting provider. These are the named sub-processors. The sub-processors page lists what each touches.
Questions about where your data lives?
Ask us about hosting, encryption or your account, and we will give a straight answer.