Trust Centre

UK GDPR & data protection FAQ

Direct answers based on InsightOS's published Security page, Data Processing Addendum, International Transfers Addendum and Responsible AI Policy. These summaries do not replace the full documents or legal advice.

Does InsightOS comply with UK GDPR?

InsightOS states that it processes customer data in line with UK GDPR and the Data Protection Act 2018. The Data Processing Addendum describes the processor relationship and related responsibilities. Customers remain responsible for their own lawful basis, privacy notices and instructions.

Where is InsightOS data hosted?

The Security page and DPA identify IONOS infrastructure and state that primary application infrastructure is hosted within the European Union. The documents also note that some third-party services may process information in other locations, depending on the service and provider.

How does InsightOS protect customer data?

Documented controls include role-based access, restricted administrative and database access, authentication controls, monitoring and logging, rate limiting, IP-based controls, incident response procedures and controlled production access. Details are in the Security page and DPA.

Does InsightOS encrypt data?

Connections to InsightOS use HTTPS/TLS. Data stored within InsightOS infrastructure is protected using AES-256 encryption at rest where supported by the underlying storage infrastructure. Third-party providers may apply their own encryption controls.

Does InsightOS use customer data to train AI models?

The Responsible AI Policy says InsightOS does not intentionally provide Customer Personal Data to public general-purpose AI models for unrestricted model training, and will not intentionally use it to train a general-purpose model for unrelated commercial purposes without an appropriate basis, arrangement or authorisation where required.

Does InsightOS use OpenAI?

OpenAI is identified in the DPA's Sub-processor Register for AI-assisted InsightOS functionality. Whether it is involved depends on the enabled feature. The DPA documents contractual transfer safeguards for relevant processing.

What subprocessors does InsightOS use?

The DPA currently lists IONOS, IONOS Cloud, Bunny.net, OpenAI and Google reCAPTCHA Enterprise, with their described purposes and location/transfer notes. Refer to Schedule 3 of the DPA for the current documented register.

Can customers delete or export their data?

The DPA provides for Customer Data to be returned or deleted at the end of the Services at the Customer's choice, subject to legal retention, legal claims and secure backup lifecycle exceptions. It describes deletion from active production systems after the applicable export period; customers should contact support for account-specific requests.

How does InsightOS handle data subject requests?

Under the DPA, InsightOS will direct an individual making a request about Customer Data to the Customer where legally permitted, and will not respond substantively unless authorised or required by law. The Customer, as Controller, is responsible for responding to requests and may seek assistance from InsightOS as described in the DPA.

How long is customer data retained?

Retention depends on the subscription or applicable agreement, any export period, legal requirements and the backup lifecycle. The DPA describes deletion or anonymisation from active production systems after the applicable export period, with exceptions for law, legal claims and secure backups. It does not state a single universal retention period.

Can customer data be transferred outside the UK?

Some third-party services may involve processing outside the UK or EU. Where a transfer is a restricted transfer, the DPA and International Transfers Addendum describe use of an applicable safeguard, such as an adequacy mechanism, IDTA or UK Addendum to the EU SCCs, where required.

Who can access customer data?

The DPA says access is limited to personnel who require it to perform, secure, support, maintain or administer the Services. It also describes role-based permissions and restricted administrative and database access.

How does InsightOS handle security incidents?

The DPA says InsightOS will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Data. The Security page describes assessment, containment, investigation, remediation and notification where legally required.

Does InsightOS support multi-factor authentication?

The Security page and DPA document multi-factor authentication as an available security control. Availability may depend on the relevant account or feature configuration.

How does InsightOS approach responsible AI?

The Responsible AI Policy describes AI as assistive decision support, calls for human review of important outputs, and advises against relying on AI alone for significant employment decisions. It also covers data minimisation, access controls, model limitations, testing and AI security risks.

What analytics cookies does the website use?

The website's consent component offers separate accept and reject choices for optional analytics. The Google Tag Manager script is added only after analytics acceptance. You can reopen cookie preferences using the control in the site footer.