Ask where your systems and data will live, and "in the cloud" is the answer you will often get. It sounds reassuring. It tells you almost nothing. For a UK business — especially one handling customer data — three specific questions matter, and each has a concrete answer.

1. Which country is the data in?

Data residency determines which legal regime primarily applies to your data and satisfies the expectations of your own customers and regulators. Solutions we host run on Microsoft Azure in UK/EEA regions — the specifics, along with links to Microsoft's own official documentation, are in our Hosting & Data Residency statement.

2. Who is actually securing the infrastructure?

When software is hosted on Azure, the physical and platform security is Microsoft's — and it is independently certified against ISO/IEC 27001, ISO/IEC 27017/27018, ISO 9001 and SOC 1/2/3, with certificates verifiable through the Microsoft Service Trust Portal. What your partner adds on top — access control, configuration, patching discipline — is where their posture matters: ours is written down in Information Security & Access Control.

3. What happens on a bad day?

Disks fail, regions have outages, mistakes happen. The question is not whether a bad day comes but whether recovery has been thought through before it does: what gets backed up, how restores are tested, and how quickly service returns. Our Business Continuity & Disaster Recovery statement describes how hosted services are recovered after disruption — and our incident response commitments cover how you would hear from us under UK GDPR if an incident ever touched your data.

The questions worth asking about backups

Backups are where reassuring answers most often fall apart, because "we take backups" is every bit as vague as "in the cloud". You do not need to be technical to probe it properly. If you only have five minutes with a potential supplier, these are the questions our clients find most revealing:

  • What is actually backed up? The database is the obvious answer, but uploaded files, configuration and everything needed to rebuild the environment matter just as much on the day you need them.
  • How much work could we lose? If the system failed five minutes after your busiest hour of the week, how far back does the most recent backup reach? The honest answer is a number, not "don't worry".
  • Has a restore ever been tested? A backup that has never been restored is a hope, not a plan. Ask when a restore was last rehearsed, and how long it took to get a working system back.
  • Where do the backups live? Residency applies to the copies too. A UK-hosted system with backups replicated to another jurisdiction may not be the arrangement you thought you were buying.
  • Who else is involved? Hosting providers, monitoring tools and other subprocessors all touch a live service. A supplier should know their own supply chain and hold it to the same standard they ask you to trust, which is what our supplier management statement commits us to.

None of these questions require technical knowledge to ask, and none of the answers should require technical knowledge to understand. A partner who can answer them plainly, in writing, has done the thinking before the bad day; one who turns vague under gentle pressure is showing you exactly where the gaps are. We keep our own answers to the questionnaire staples in one place, on our common due-diligence questions page, precisely so nobody has to take our word for it. And if you are still assembling a shortlist, our guide to vetting a software development partner applies the same approach well beyond hosting.

And one more: can you leave?

The healthiest hosting relationship is one you could exit. You own your data — contractually, not as a courtesy — and our Data Ownership & Portability statement says so in writing. In our experience, suppliers confident enough to document your exit are the ones you never feel the need to leave.

If you are planning a move to the cloud or weighing where a new system should live, our cloud migration service and Azure development pages cover the how; the Trust & Compliance Centre covers the assurances.

If you are weighing up a software partner and want the paperwork as well as the promises, our Trust & Compliance Centre has the statements ready to read — and we are happy to walk you through any of it. Start a conversation.