Trigger 
Describe Trust centre
Where your data does — and doesn't — go.
Plain answers on data flow, sub-processors and key custody. If anything here is a blocker for your procurement process, we'd rather you found out now.
Data flow
The portal stores organisation, membership and licence metadata in its own database. It does not accept document uploads for conversion in this phase, so no filing content passes through this deployment. Release artifacts are served from a pluggable store — currently a local filesystem store on the portal's own host.
Sub-processors
Billing is a pluggable gateway; no billing sub-processor is active until it is configured for a deployment, and no payment details are ever handled directly by this application. When enabled, billing runs through Stripe (Checkout, Billing Portal, Stripe Tax).
Key custody
Licence signing uses a pluggable signer abstraction. A file/PEM-backed signer is available for development and staging; production deployments are intended to use a KMS-backed signer so the private key never exists on the application host. See the portal specification for the design.
For the technical detail behind these summaries, see Security and the full security documentation.