Your data stays
in the UK.
Construction data is sensitive — people's identities, their right to work, your commercial position on live jobs. So here's exactly where it lives, what leaves and what doesn't, in plain terms.
Your records live in the UK
The database that holds your projects, people, RAMS, competence and compliance records runs on infrastructure in London (AWS eu-west-2). It doesn't leave the UK.
Your files live in the UK too
Documents, site photographs, certificates and right-to-work evidence are held in a private Vercel Blob store in the London region (lhr1) — not a US bucket with a UK label on it.
Processing happens in London
The application itself runs in the London region, next to the data — so your information is handled here, not shipped across the Atlantic to be processed.
Encrypted, in transit and at rest
Everything travels over TLS, and sensitive records — like right-to-work evidence — are encrypted before they're stored. Access is scoped to your company and your people's roles.
The one thing that leaves: the AI
When you ask Stathia to draft a document, the text you give it goes to our AI provider in the United States and the draft comes back. Nothing else in the product leaves the UK, and nothing you send is used to train models.
Your data is yours
We don't sell it, share it, or use it to train anything. You can export everything your company owns at any time from Settings, and take it with you if you leave.
The detail
- Database: PostgreSQL hosted in AWS London (eu-west-2), with encryption at rest and point-in-time recovery.
- Application: runs in the London (lhr1) region.
- File storage: documents, photos and certificates are held in a private Vercel Blob store in the London region (lhr1), and served over authenticated links rather than open URLs. Right-to-work evidence goes further again — it is streamed through a company-scoped route so the storage URL is never handed to a browser at all.
- AI drafting: the scope, specification and drawing text for the document you're drafting is sent to Anthropic in the United States, under standard contractual clauses with the UK addendum, and the draft comes back into your account. It is the only part of Stathia that processes your content outside the UK, it only happens when you ask for a draft, and every module works without it.
- Email: transactional email (invites, resets, notifications) is sent via Resend. No customer records are shared for marketing.
- Payments: handled by Stripe. Card details go to them directly and are never stored by Stathia.
- Access: scoped per company and per role. Nobody outside your company sees your data, and we don't use it to train AI models.
The full list of everyone who processes data on our behalf — what they do and where they are — is in the privacy policy, alongside how long each category of data is kept.
Handling something with specific data-protection requirements? Ask us — we'll give you a straight answer, not a runaround.