When a contractor uploads the drawings for a secure building, or an estate connects its CCTV, there’s a question that deserves a straight answer: where does this data actually live? For everything we build, the answer is the United Kingdom, by design.
What data residency actually means
Data residency is about two things: where your data is stored (the database, the files, the backups) and where it’s processed (the servers running the application, and increasingly the AI models reading it). Both matter. A UK database is not much comfort if every request is processed somewhere else.
It’s also one layer, not the whole story. Residency sits alongside encryption, access control and an audit trail; it doesn’t replace them.
Why it matters for the work we do
- The data is sensitive. Security system drawings, access control layouts, camera positions, door schedules, test certificates with engineers’ names on them, who is on site and when, and CCTV footage. A set of security drawings is, quite literally, a map of how a building is protected.
- Clients ask. Universities, estates teams and main contractors increasingly want to know where a supplier hosts their data before they sign up. “London” makes that answer short.
- UK GDPR is simpler when data stays here. Moving personal data out of the UK needs extra legal safeguards. Keeping it in the UK takes that layer of paperwork and risk away from our customers.
- AI raises the stakes. Sending project data to an AI model is processing, and plenty of AI tools process wherever their provider has spare capacity. We pin it down instead.
- It’s faster. Servers in London are close to the people using them.
What that looks like in our products
Graftix
Every drawing, task, photograph, certificate and Vault entry is stored and processed in the UK, and there is no other storage region. The application runs on Google Cloud in London, the database on AWS in London, and files and photographs in AWS S3 in London, encrypted at rest. All AI inference, including Dave, runs through AWS Bedrock in London. The full breakdown is on the Graftix security page.
Kenaez
The platform runs in London, and the database and event media are stored in London too. AI analytics run on an edge node on site, which only ever makes outbound connections, so a lot of the work never leaves the building. When the AI needs a second opinion, the escalation model is hosted in London; routine AI checks use an inference setup that stays inside the EU. Kenaez does not train AI models on your footage.
Ceodore
Servers, database and backups are all in the United Kingdom, which matters when the data is payments and a business’s books.
Relocar
Relocar, our job book and dispatch board for vehicle transport operators, is hosted in the UK, with its data stored here too.
Regimate
Regimate, still in development, runs in the UK and keeps its database here. Photos and files are held in Cloudflare’s EU storage, all under UK GDPR.
The one path we can’t guarantee
Graftix and Kenaez both let you connect your own AI assistant over MCP, or use your own AI provider. That’s a deliberate choice for customers who want it, but on that path the requests go to your provider, under your terms, wherever they run. We say so plainly in the product, because residency only means something if the exceptions are written down too.
Questions worth asking any software supplier
- Where is the database, and where are the files and backups?
- Where does AI processing happen, and is my data used to train models?
- Who are your sub-processors, and where are they?
- Can I have a data processing agreement?
- What happens to my data when I leave?
If a supplier can’t answer those in a sentence each, that tells you something.
Building something that needs to stay in the UK?
We build websites, apps and integrations with UK hosting as the default, and we’ll tell you straight where anything can’t be. Have a look at what we build online, or get in touch.