Data residency and on-premise deployment for an Iranian marketing platform

The short answer

The rest of this page is the detail behind those five lines, and one article listing the controls we do not have. A vendor that wins every row of its own comparison is believed by nobody, and the fastest way for a buyer to find that out is to check one claim.

The three deployment modes

The difference between them is where the data physically lives and who operates the machine it lives on. Everything else, meaning the access control, the audit log, the test environment and the retention policy, is identical in all three.

Setup time is the honest cost of the other two. One business day against two to three weeks is not a sales figure, it is the difference between provisioning a tenant on a system that is already running and standing up an installation, its database, its event store and its queues on hardware nobody has configured yet.

Residency is not custody, and this page will not blur them

Residency means the data is stored inside a particular country. Custody means a particular organisation holds it. They are different guarantees and a marketing page that says one while meaning the other is the single easiest claim for a reviewer to catch.

Our own home page said «your customers' data never leaves your organisation» until 2026-08-12, while the table eight lines below it described residency in two of its three columns. It now says «stays in the country you choose», which is true in all three, and the stronger claim lives in the third column where it is actually true. We mention the correction because a buyer who is verifying us will eventually find both versions.

Who at our company can read your data

Our internal panel is a separate surface on a listener that is not routed from the internet, and its rules are stricter than the customer panel's rather than the same:

• The second factor is mandatory and the database structure enforces it. A staff record without a confirmed second factor is not valid, so an account that declined enrolment cannot sign in at all.
• Reads are logged, not only writes. The question an investigation asks is which member of staff opened a particular person's record, and a log of writes does not answer it.
• Every change carries a written reason.
• High-risk work requires the second factor again within the last ten minutes: entering a customer account with write permission, deleting an account, changing a staff role. The threat that rule exists for is an unlocked stolen laptop, not a stolen password.
• Entering a customer account is read-only by default, and any change made in write mode is recorded in the customer's own audit log under a distinct label.

All of that is published in full in our Security Document, which is a public page rather than a document you receive after signing an NDA.

Encryption, isolation and backups

In transit, every public endpoint answers only over TLS and an unencrypted request is redirected. At rest, the secrets whose disclosure from the database alone would be dangerous are encrypted with AES-GCM before they are written, with the key in the process environment rather than in the database, so a stolen dump is not on its own enough.

Tenant isolation is logical rather than physical: shared infrastructure with a tenant identifier on every table, every key and every partition key, and a data layer that runs no query without it. A dedicated deployment is possible and is not the default. We say logical rather than implying physical because the difference is exactly what a reviewer is asking about.

Backups run nightly and do not leave the country. They are encrypted with a public key whose private half is deliberately not on the server, because somebody who has taken the server has the backup files too, and encryption whose key sits beside it is not encryption. Restoring is rehearsed rather than assumed: a backup that has never been restored is not a backup.

What we do not have

This article getting shorter is good news, and every time it does, the Security Document changes with it. Today:

• No ISO 27001 and no SOC 2 certification.
• No third-party penetration test report.
• No AFTA certificate. That one is for cyber security providers and government contractors rather than for a marketing platform, but a banking or government buyer may still ask for it.
• Field-level encryption of end-user identity items, meaning the mobile number and the email address, is not yet complete.
• Physical isolation of tenants is not the default.

What happens to the data when you leave

Export first, deletion second, and both on a stated clock rather than on request. After a subscription ends the panel stays open for an export window, and after a further window the account's data is deleted under the Retention and Deletion Policy. The data stays inside Iran until the moment it is deleted.

One thing is deliberately not deleted: opt-outs recorded by recipients. If a customer returns later those opt-outs still stand, because an opt-out is the recipient's right rather than a setting on the customer's account.

Technical logs and traffic data are counted separately and a deletion request does not remove them. Whether the statutory duty to retain traffic data reaches us exactly is not clear, so we do not declare it as a settled obligation of ours, and we keep the most conservative reading.

Questions you may have about this