Findings, screenshots, documents, PII analysis, remediation tracking and every user account — on infrastructure they own, under their own DPA.
Database backups, access controls and disaster recovery.
No analytics and no telemetry leave this estate — we cannot read their results.
Single-jurisdiction infrastructure: no multi-region replication to reason about.
They never call us over HTTP. Their frontends and services talk only to their own broker; the broker federates across the private link.