UK-only processing
Production, replication, backup and support all inside the United Kingdom.
Security & compliance
Your email stays in the UK. In writing.
Data residency, encryption, resilience and filtering are not add-ons here. They are the reasons a British business chooses a British Exchange platform over a global one, so they are included and they are documented.
Data residency
Where your mail lives, and who can touch it
The single most common reason customers come to us from a hyperscale platform.
Your mailbox databases, their replicas and their backups are held on infrastructure we own and control, inside United Kingdom data centres. Nothing is processed, cached or supported outside the UK. Support is delivered by our own engineers in Birmingham — not an offshore first line with a remote session into your tenancy.
That is a contractual commitment written into your data processing agreement, which means it is something you can put in front of an assessor, a client's procurement team or an insurer. "Probably in Europe somewhere" is not an answer that passes a framework submission.
It also has a practical benefit that has nothing to do with compliance: when something needs investigating, the person investigating it is in the same time zone as you, and can open a PowerShell session against the specific server your mailbox is on.
Written into the contract
A data processing agreement naming sub-processors, retention and breach notification.
UK support staff
Named engineers in Birmingham, directly reachable, with no offshore tier one.
Threat protection
Six layers between the internet and your inbox
Email is still how most breaches start. The filtering below is included with every mailbox, with two optional layers for organisations that need more.
At the edge
Connections are rate-limited and reputation-filtered before they reach Exchange. Known-bad senders, hijacked relays and dictionary attacks are dropped at the perimeter rather than delivered and then cleaned up.
In the filter
Multi-layer content scanning, signature-based anti-virus and heuristic analysis. Suspected spam is quarantined rather than deleted, and users can review their own quarantine.
Against impersonation
Display-name spoofing and lookalike-domain detection, aimed at the invoice-redirection fraud that targets finance teams. Optional attachment sandboxing and URL rewriting for higher-risk organisations.
At authentication
TLS 1.2 or better enforced on every connection. Optional multi-factor authentication on Outlook Web App and the control panel, enforceable across a whole organisation.
At rest
Volume-level encryption on every mailbox database and every backup set, on hardware we own inside UK data centres.
On devices
Mobile device policies can require a PIN, enforce device encryption and block jailbroken handsets. Any device can be remotely wiped from the control panel.
Resilience
Built so a single failure is not your outage
Exchange is only as good as what sits underneath it.
-
Database Availability GroupsEvery mailbox database is replicated across multiple Exchange servers. If one fails, the database mounts on another automatically — usually before anyone notices.
-
UK data centres, pluralProduction and replica infrastructure sit in separate UK facilities with independent power and connectivity.
-
Daily off-host backupsBackups are written away from the production platform, retained for 30 days, and test-restored on a schedule so we know they work.
-
30-day recoveryDeleted items and deleted mailboxes are recoverable for 30 days as standard. Longer retention is available where a regulator requires it.
-
Monitored around the clockPlatform monitoring runs 24/7 with alerting to on-call engineers. Mail flow, queue depth, database health and certificate expiry are all watched.
-
99.9% uptime SLAMeasured monthly and backed by service credits. Our SLA is published in full rather than summarised.
Compliance
What we can put in front of an assessor
If you are completing a Cyber Essentials questionnaire, a DSP Toolkit submission or a client security review, these are the answers you need from an email provider.
-
UK data residencyMailbox data, replicas and backups are held only in the United Kingdom. This is a contractual commitment, not a best-efforts statement.
-
Data processing agreementA written DPA is provided as standard, naming us as processor and setting out sub-processors, retention and breach notification.
-
UK GDPR alignmentProcessing is limited to what is needed to deliver the service. Support is delivered by our own staff in Birmingham; no third party outside the UK handles your mailbox content.
-
Right to erasure and portabilityOn request or on leaving, we export mailboxes to PST and confirm deletion of the originals and their backups in writing.
-
Auditable administrationEvery administrative action in the control panel is logged with the account and timestamp, and those logs are available to you.
-
Evidence for assessmentsWe provide the data centre certifications, architecture summary and policy documents needed for Cyber Essentials, DSP Toolkit or a public sector framework submission.
A note on honesty. We are an IT services company, not a certification body. Where a control is delivered by our data centre partners rather than by us, we say so and provide their certifications. Where something is not in place, we tell you that too — you will get a straight answer rather than a page of logos.
Questions
Security and compliance FAQs
Where is my email actually stored?
In UK data centres, and only in UK data centres. Your mailbox databases, their replicas and their backups all sit on infrastructure we control on British soil, and that commitment is written into your contract. Support is delivered by our own engineers in Birmingham, so nobody outside the UK handles your data.
Which version of Exchange Server do you run?
Exchange Server Subscription Edition, the current supported on-premises release, deployed in a Database Availability Group so every mailbox database is replicated across multiple servers with automatic failover. We keep the platform on current cumulative updates and apply security updates on a managed schedule.
Do you offer a service level agreement?
Yes. We commit to 99.9% platform availability measured monthly, with service credits if we miss it. Support runs Monday to Friday, 09:00 to 17:30, with 24/7 emergency cover for platform-affecting incidents. Business Critical customers get out-of-hours response as standard.
Need the documentation for an assessment?
Tell us which framework you are working to and we will send the architecture summary, data processing agreement and data centre certifications. No sales call required first.
- Free assisted migration
- No set-up fee, no minimum term
- UK data centres, UK engineers