Where client data is stored and processed
WiBiz is cloud-only, but it does not use one universal architecture or region for every service. A truthful answer must name the assessed build, environment, provider, project, region, data category, processing purpose, backup path, and support-access geography.
Organisation-wide fact
WiBiz does not operate a company server room or company LAN. Services use managed cloud providers selected for the applicable build and business function.
Verified example
The referenced Pulse production database project uses Neon in AWS Asia Pacific Singapore. This evidence applies to that named project and is not automatically inherited by every client build.
Required client answer
The final provider, location, data flow, access model, retention, recovery, and service-provider schedule are approved in the versioned Build Security and Data Annex before production.
The per-build record
Each production build must identify all of the following. A generic policy does not replace a missing value.
- •The exact personal, sensitive, operational, and service-generated data fields
- •Controller, processor, data-intermediary, and provider roles
- •System and data-flow diagram, including transfer and replication paths
- •Cloud providers, projects, services, countries, and regions
- •Authentication, privileged access, service identities, and client roles
- •Encryption implementation, key responsibility, and secrets handling
- •Logs, alerts, retention, reviewer, and client audit-log availability
- •Backup method, separation, recovery objectives, and restore result
- •Retention, export, deletion, backup deletion, and legal-hold behaviour
- •Service providers, subprocessors, data locations, and open evidence
- •Security tests, independent test scope, findings, retest, and expiry
- •Known limitations, shared responsibilities, exceptions, and approvals
Unknowns remain visible
Where a provider region, backup location, account setting, contract, retention rule, or support-access path has not been independently verified, the record states not yet confirmed or to be agreed before production. WiBiz does not substitute a policy requirement for missing operating evidence.