Hosting

Hosting & Data Residency

UK-region hosting on Microsoft Azure, backed by Microsoft's independently audited certifications and financially backed service level agreements.

Trust & Compliance Centre · Last reviewed: March 2026

At a glance

Is your hosting infrastructure located within the UK or EEA? Yes Microsoft Azure UK regions (UK South, with UK West available for resilience)
Do your third-party hosting providers hold ISO 27001 certification? Yes Microsoft Azure is ISO/IEC 27001 certified — see verification links below
Do you guarantee a minimum uptime SLA for hosted services? Yes Backed by Azure's financially backed SLAs (typically 99.9%–99.99% per service); engagement-specific SLAs are agreed in writing

Where customer services are hosted

Assemblysoft hosts customer solutions on Microsoft Azure. Unless a customer requests otherwise, services are deployed to Azure's UK regions — UK South (London area) as the primary region, with UK West (Cardiff area) available for redundancy and disaster recovery. Customer data at rest therefore remains within the United Kingdom.

Where a customer has an existing Azure estate or a specific residency requirement (for example, EEA-only processing), deployment regions are agreed at the start of the engagement and recorded in the project documentation.

Microsoft publishes its data residency commitments for the UK geography, including the physical location of UK data centre regions, in the official documentation linked below.

Hosting provider certifications

Physical data centre security, environmental controls, and platform-level security are operated by Microsoft and covered by Microsoft's independently audited certification programme, which includes ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO 9001, SOC 1/2/3, and the UK Government's Cyber Essentials Plus scheme. Certificates and audit reports are published by Microsoft and can be verified directly:

Uptime and service level agreements

Hosted services are built on Azure platform services that carry Microsoft's financially backed SLAs — typically between 99.9% and 99.99% monthly uptime depending on the service and tier deployed (for example, Azure App Service and Azure SQL Database each carry a 99.9%+ SLA at standard tiers). The authoritative, current SLA for each Azure service is published by Microsoft:

Engagement-specific service levels — including any uptime commitment Assemblysoft provides on top of the platform SLA, support response times, and maintenance windows — are agreed in writing per engagement, consistent with our Master Services Agreement. This ensures the SLA you receive reflects the architecture actually deployed (single-region, zone-redundant, or multi-region) rather than a generic figure.

Platform security measures

  • Encryption in transit (TLS) for all public endpoints, and encryption at rest for Azure storage and database services.
  • Network controls including firewalls, private endpoints, and IP restrictions as appropriate to the solution.
  • Managed identities and Azure Key Vault for secrets, avoiding credentials in code or configuration.
  • Platform patching of underlying infrastructure handled by Microsoft as part of the managed service model.

Need engagement-specific detail?

Architecture diagrams, region configuration, and the specific Azure services (and their SLAs) used for your solution are documented per engagement and shared directly. Contact hello@assemblysoft.com.

Back to the Trust & Compliance Centre

Start a meaningful conversation with us today.

FAQs

Assemblysoft are Your Safe Pair of Hands

Microsoft Azure

Azure

Azure DevOps

Azure DevOps

Blazor

Blazor