For the bigger picture, start with AdviceAid security and compliance: start here.

A reminder that frames everything below: the only personal data AdviceAid holds is your staff members' names and email addresses, used for sign-in. AdviceAid holds no citizen records or resident data. So while we take data protection seriously, the volume and sensitivity of personal data involved is very low.

Where AdviceAid is hosted

  • Microsoft Azure, UK region. All council data is stored within the UK.

  • Software as a Service. AdviceAid is fully hosted and managed by Neatlines. There is no on-premise option.

  • Multi-tenant. Each customer's data is separated at application level by a unique organisation ID. Users only see data belonging to their own organisation, or data that has been explicitly shared with them.

Who our sub-processors are

AdviceAid relies on two established sub-processors:

  • Microsoft Azure (UK region) for application hosting and the database.

  • Amazon Web Services, specifically Amazon Simple Email Service in the AWS Europe (London) region, for delivering outbound email such as advice sheets.

Neatlines is a UK company. Access to live systems is restricted to a small number of named Neatlines staff.

How data is protected in transit

  • All connections use HTTPS on port 443, with TLS 1.2 or higher.

  • HTTP Strict Transport Security (HSTS) is enabled on all AdviceAid web applications.

  • Public-facing sites hold an A+ rating on the Qualys SSL Labs test. You can check this yourself, for example at https://www.ssllabs.com/ssltest/analyze.html?d=app.adviceaid.uk.

How data is protected at rest

  • Data is stored in Microsoft SQL with Azure Transparent Data Encryption (TDE), using server-level keys.

  • Data is backed up every day using an enterprise-class backup solution. Backups are encrypted.

  • Backup data is held in a separate location for geographical separation, and is kept for a 30-day retention period.

Disaster recovery, recovery objectives and business continuity are covered in Resilience and incident management.

Email sending

Where AdviceAid sends email, for example when an adviser emails an advice sheet, delivery is handled by Amazon SES in the London region. The adviceaid.uk domain is configured with SPF, DKIM (2048-bit keys) and DMARC, and mail is sent over TLS. The content of these messages is not retained.

Data return at the end of the contract

  • The advice content your team writes belongs to you. You can export it as a Word document at any time, including at the end of the contract.

  • When a contract ends, your data is removed from the live environment, and backups containing it cycle out within the 30-day backup retention period.

  • AdviceAid uses only managed cloud resources. Underlying hardware is disposed of by the cloud provider in line with their own certified processes. AdviceAid uses no removable media.

What is out of scope here

Because AdviceAid is browser-based SaaS hosted in Azure, questions about on-premise servers, removable media, and connections into your own network do not apply. See the out-of-scope list in AdviceAid security and compliance: start here.

Who to contact

For questions about hosting, data location or data return, contact Peter McGuire at peter.mcguire@adviceaid.uk.