Security & data protection
Quick answer: RETAIN is UK GDPR-native with EEA data residency, row-level tenant isolation, and encryption in transit and at rest — built on infrastructure from Supabase, Vercel and Stripe, whose independent certifications cover the layers they operate.
What RETAIN commits to
- UK GDPR-native — CX Advisory Ltd is the registered Data Controller (ICO ZB912842) and acts as Data Processor for the customer data you manage in the platform
- EEA data residency — the platform database runs in Supabase’s eu-west-1 region
- Tenant isolation by Row-Level Security — every table is scoped to your organisation; another customer’s org cannot read your rows
- Encryption in transit (HTTPS everywhere) and at rest
- Data Processing Agreement available on request
The infrastructure underneath
RETAIN does not hold SOC 2, ISO 27001 or PCI DSS certifications itself — those belong to the infrastructure providers the platform is built on, and we name them rather than borrow their badges:
Supabase
Database, authentication and storage infrastructure
Maintains SOC 2 Type II compliance; RETAIN runs in its eu-west-1 (Ireland) region
Vercel
Hosting and deployment
Maintains SOC 2 Type II and ISO 27001 certifications
Stripe
Payments — card details never touch RETAIN systems
PCI DSS Level 1 certified payment processor
Questions or requests
For a Data Processing Agreement, data-handling questions, or security concerns, contact support@cxretain.co.uk. Full detail on what we collect and why is in the privacy policy. CX Advisory Ltd · Company No. 16469923 · ICO ZB912842.