# Gladstone Cloud Data Security FAQ

HTML version: [Gladstone Cloud Data Security FAQ](https://support.gladstonesoftware.cloud/gooperator/gladstone-cloud-data-security-faq)

## Problem
Customers and compliance teams need to understand how data is stored, protected, and managed within Gladstone Cloud, including information about data residency, encryption, backups, data separation, breach notifications, and data ownership.

## Resolution
1. **Data Storage Location**
   - All data in Gladstone Cloud is stored in the Azure UK South data centre, located in London.
   - This environment is hosted within the UK to meet UK data residency requirements and is a Tier 3 data centre for secure and resilient hosting.
   - More about Azure compliance: [Microsoft Azure Compliance Documentation](https://learn.microsoft.com/en-us/azure/compliance/).

2. **SSL Certificates**
   - Gladstone provisions and manages SSL certificates for customer environments.
   - Customers do not provide their own SSL certificates, which avoids issues with expired certificates.
   - For the signature platform, customer environments can be linked to custom domains without requiring customer-provided SSL certificates.
   - This functionality is under development for GladstoneGo.

3. **Data Security and Encryption**
   - Gladstone Cloud uses modern encryption standards for all data.
   - Data is encrypted at rest using Microsoft’s latest encryption technologies and is replicated across three availability zones.
   - The platform uses modern SQL Server engines to tag and track sensitive data for enhanced monitoring and security.
   - Detailed reporting is available on request.

4. **Data Separation**
   - Each customer has an isolated SQL instance, logically separated and protected within a structured SQL server.
   - Controls are in place to prevent any customer from consuming disproportionate platform resources, ensuring consistent performance.

5. **Backups**
   - Customer data is backed up every six minutes.
   - Backups are retained for seven days, with additional monthly and yearly snapshots for long-term recovery.

6. **Data Change Tracking**
   - Row-level database auditing is enabled across all tables.
   - Creation and modification events are tracked separately, providing full visibility of data changes.

7. **Data Breach Notification**
   - If a confirmed breach affects a customer environment, customers are notified within 24 hours of confirmation.
   - Gladstone maintains incident-management procedures as part of its ISO27001 certification.

8. **Right to be Forgotten**
   - Customers can request data deletion in line with GDPR.
   - Products have built-in purge functionality, and Gladstone’s team can assist with additional data removal if required.

9. **Data Ownership**
   - Customers remain owners of their data and act as data controllers under GDPR.
   - Gladstone only hosts and monitors the environments; ownership stays with the customer.

## Notes
- Compliance standards, infrastructure, and platform capabilities may change over time. Contact Gladstone for the most up-to-date information.
- The breach notification timing above is for a confirmed breach. [Gladstone Cloud Security, Compliance and Data Protection FAQ](gladstone-cloud-security-compliance-and-data-protection-faq.md) describes incident communication as following investigation, with timing that depends on severity. Contact Gladstone if you need the commitment that applies to your contract.
- Related articles:
  - [Gladstone Cloud Platform Security and Operational Resilience FAQ](gladstone-cloud-platform-security-and-operational-resilience-faq.md)
  - [Gladstone Cloud Security, Compliance and Data Protection FAQ](gladstone-cloud-security-compliance-and-data-protection-faq.md), which also links the Gladstone Privacy Policy
  - Gladstone Trust Centre