Trust
UK data residency
OTHRS is built for UK social and care housing. Our platform is designed so that data about UK organisations, commissioners, opportunities and demand stays within UK jurisdiction by default.
Primary data residency
All primary application data — organisations, members, opportunities, demand records, formation rooms, messages and documents — is hosted in UK-based infrastructure regions operated by our hosting provider.
Processing
Application processing runs in UK-region serverless workers. Background workers and scheduled jobs run in the same UK region as the primary data store.
Backups
Encrypted backups are retained in the same UK region. Cross-region replication is not enabled by default.
Sub-processors
We minimise third-party processing. Where a sub-processor is necessary (for example, transactional email delivery), we contract for UK or EEA data processing where it is offered.
UK GDPR & DPA 2018
OTHRS processes personal data as a data processor on behalf of member organisations under written terms reflecting the UK GDPR and the Data Protection Act 2018.
Access controls
Production access is limited to a named on-call engineering rota, scoped to least-privilege roles, with audit logging on every privileged action.