Legal
Data Hosting and Compliance
Where your data lives, how it is protected, and the reports your IT and procurement teams ask for.
Reports and policies
Documents
- NCSC Compliance Report PDF
- Data Protection and Xperios PDF
- Xperios Security Assurance Statement PDF
- Penetration test by ServerScan, March 2026 PDF
- PCI DSS v4.0.1 self-assessment (SAQ D, service provider) PDF
- PCI DSS security standards information PDF
- ISO 27001: how our Microsoft Azure hosting meets it PDF
- Information Governance Policy PDF
Questions we are asked
- Where is the data hosted?
- Customer data is held in Microsoft Azure’s UK data centres.
- What security standards do the data centres meet?
- Microsoft Azure holds ISO 27001 and other security certifications for its data centres. Those are Microsoft’s certifications, not Paritor’s.
- Is the data backed up?
- Yes. Every customer database is backed up and encrypted at rest, and we can restore it to any point in the last 7 days. Longer backup periods come with Standard and Enhanced support: Standard adds a weekly copy kept for 4 weeks, and Enhanced also keeps a monthly copy for 3 months.
- Can we control who has access?
- Yes. Every user has their own named login, and your administrators decide what each user can see and whether they can change it.
- Are online payments protected?
- Card payments are taken by PCI DSS-compliant payment providers, never by our own servers. Our PCI DSS self-assessment and our latest external penetration test are in the documents above.
- Can we connect our own reporting system?
- Xperios has an API for exchanging data with your own systems, including BI and reporting tools.
- Who do we ask for something else?
- Contact us, and tell us what your IT or procurement team needs.