When you use an AI feature, the content needed for that request goes to our model providers, which may operate in other regions. It is not used for training, and prompts and outputs are kept under Drova's retention policy. The detail is on AI trust.
Where Drova holds your data
Drova operates dedicated regional hosting environments, where your data is stored and processed.
Customers choose their hosting region at onboarding. This page sets out what your region covers, what it does not, and how anything that leaves it is protected.
Doing your due diligence? Good.
Leave your work email and we will come back to you with the certificate, policies and answers your IT or procurement review needs.
Hosting region
Your region
Customers choose their hosting region at onboarding. Your platform data is stored and processed in that region and stays there.
- What your region determines. Your region sets where your Drova environment is hosted. The application, the database and the backups that serve your organisation all run in that region's dedicated environment.
- What it does not guarantee. A region does not mean that every supporting service, network path or subprocessor operates only in that region. The services that run around the platform, what each one does and where, are listed on our subprocessor page.
- Kept separate. Each regional environment has its own storage and its own access controls, production is separated from non-production, and nothing is shared between regions by default.
How a regional environment is set up
One dedicated environment per region, each with its own load balancer, application and database, backed up within the region.
Step by step
The path your data takes
- Into the platform. Traffic from your users passes through a web application firewall before it reaches your region's load balancer, then the application, then the database. Nothing from the public internet reaches the application directly.
- Inside the region. The load balancer, the application and the database for your organisation all run in your region's AWS environment.
- Backed up in the region. Each region's data is backed up to a separate AWS availability zone within the same region, so a failure in one zone can be recovered from another without the data leaving the region.
- Engineering access. Drova's engineers reach the platform over a VPN, inside the access controls described on Security.
In region
What stays in the region
- Your platform data. All the content your team puts into Drova is stored in your region's environment. Examples include risks, controls, obligations and requirements, policies, evidence and documents, tasks, assessments, important business services and scenario tests, materiality assessments, and the reports built from them.
- Written into your contract. Where your platform data is held is governed by your customer agreement, so the region can be specified contractually and does not change without you.
- Backups. Backups are taken and restored inside the same region, and recovery is tested every year without moving data between regions.
- Account and contact data is different. The personal data Drova holds as the responsible party, such as your name, work email and billing details, is stored in Australia and may be processed or accessed in other regions, as the Privacy Policy and our subprocessor page set out.
What leaves the region, and why
Four things that can take data outside your region, each by design and each covered below.
Some of the services that run the platform, such as the content delivery network, identity, email notifications and application monitoring, are provided by companies based outside your region. Each is named, with its purpose and country, on the subprocessor list.
Drova's own teams in Australia, the United Kingdom and Vietnam build and support the platform, so support and development access can come from those countries, always within the access controls on Security.
If your organisation switches on an optional integration, data moves to that provider on your instruction. Integrations may also use services for processing, such as those named on our subprocessor list. You choose and manage those connections.
Safeguards
How transfers are protected
- Third-party onboarding and due diligence. Before any provider is approved by Drova, Drova assesses its privacy, security and confidentiality standards and signs an agreement that imposes data protection obligations no less protective than our own.
- Only what is necessary. A provider receives the data its job needs and nothing more, under the safeguards the Privacy Policy describes for overseas disclosure.
- Reviewed at least annually. Every provider has a business impact assessment and is reviewed at least annually, inside our ISO/IEC 27001 certified management system.
- Externally audited. As part of Drova's ISO/IEC 27001 certification, our third-party processes and policies are audited, including adherence to security and privacy best practice.
Start a free trial, or tell us what your review needs.
See it for yourself
Trust Centre
More from Drova's Trust Centre
Privacy
What personal data we process and why, and how requests work.
Security
Hosting, encryption, access, testing and recovery.
AI trust
How our AI works, what it does with your data, and the safeguards in place.
Certifications and compliance
What we are certified to, and what we build to.
Your questions answered
Security, privacy, compliance and AI questions, answered plainly.
