Trust Center

🌎 Data Residency

• ✓ Case data and documents are stored in Microsoft Azure West Europe (Netherlands), with a second copy of documents in North Europe (Ireland)
• ✓ AI processing runs in Azure Sweden Central. Your data is not used to train AI models.
• ✓ Case content stays in the EEA. A few supporting services may process limited account, billing or technical data outside the EEA under Standard Contractual Clauses or the EU-US Data Privacy Framework: Microsoft Graph (your users' names and emails, for invitations), Google reCAPTCHA (browser signals from people using our website forms and application pages, including your request forms) and Stripe (billing). None of them receive case content or documents. Microsoft Entra External ID keeps directory data in the EU, and Twilio SendGrid email is sent from its EU regional account; their terms allow limited transfers outside the EEA, for example security and fraud signals or vendor support in exceptional cases, under the Microsoft and Twilio data protection terms (SCCs). Application pages also load fonts, icons and a script library from Google Fonts, Font Awesome and jsDelivr (see our Privacy Policy).
• ✓ Irish registered company (EU jurisdiction)

🔒 Encryption

• ✓ AES-256 encryption at rest
• ✓ TLS 1.2 or higher in transit (TLS 1.3 where your browser supports it)
• ✓ Encrypted database backups
• ✓ Data encrypted with Microsoft-managed AES-256 keys; application secrets kept in Azure Key Vault

👥 Access Controls

• ✓ Role-based access control (RBAC)
• ✓ Your organisation controls how its people sign in. Microsoft 365 and Google users sign in with their own account, under their provider's security settings; in our testing, a Microsoft 365 account was asked for its organisation's password and was not offered an email code. Multi-factor authentication is set by your organisation, not by SAR Portal, which has no separate MFA setting and does not check it, so we recommend you test your policy. People without Microsoft 365 or Google use a one-time email code, a single factor, so we recommend multi-factor authentication on those mailboxes. SAR Portal stores no passwords.
• ✓ Session management & timeout; sessions end when someone is removed
• ✓ Each organisation's case data and documents are kept in its own database partition and its own storage folder, with access limited by the application to the signed-in user's organisation (logical separation within shared EU-hosted resources). A few platform functions, such as sign-in lookups and scheduled jobs, read across organisations by design
• ✓ Key actions are recorded in an audit log. No user can edit or delete entries. Ask us for the full list of logged events.

✅ Compliance

• ✓ GDPR-ready by design
• ✓ Data Processing Agreement (DPA) available
• ✓ Hosted on Microsoft Azure, which holds ISO 27001 and SOC 2 certifications. SAR Portal itself is not ISO 27001 or SOC 2 certified; we hold Cyber Essentials and Cyber Essentials Plus (independently audited).
• ✓ Privacy by default settings
• ✓ Regular compliance reviews

🇬🇧 Cyber Essentials Plus

SAR Portal is operated by Sekhon IT Consultants Ltd., a Cyber Essentials Plus certified organisation — the audited level of the scheme, with the five controls verified by hands-on technical testing.

• ✓ Secure configuration
• ✓ User access control
• ✓ Malware protection
• ✓ Security update management
• ✓ Firewalls
• ✓ Independently audited (hands-on technical verification)

UK Government-backed scheme delivered by IASME on behalf of NCSC. Read more →

📞 Support & Response

• ✓ We reply to support requests within one business day (Monday to Friday, 9:00 to 17:30 Irish time). Enterprise: within four business hours.
• ✓ Enterprise customers have a named contact: one of our directors.
• ✓ Security incidents prioritised immediately

☁ Infrastructure

• ✓ Microsoft Azure cloud infrastructure
• ✓ The database has continuous backup with 7-day point-in-time restore (database and backups in West Europe)
• ✓ Documents stored geo-redundantly (Netherlands and Ireland)
• ✓ Every uploaded file is scanned for malware by Microsoft Defender for Storage. A file found to contain malware is soft-deleted from storage on detection, so it is no longer available, and it stays recoverable for 14 days in case of a false detection. SAR Portal does not hold a file back while the scan runs. We review flagged files and tell affected customers under our incident process.
• ✓ Microsoft Defender for Cloud alerts us to threats and unusual activity across the app, Key Vault, database and Azure management
• ✓ Enterprise contracts include a 99.5% monthly uptime commitment; on other plans 99.5% is our target, not a guarantee.