The short version: your compliance business data lives in your SharePoint, not ours. We designed it that way so the most sensitive information is never ours to lose.
What stays in your tenant
Forms, submissions, documents, version history and the audit trail all sit inside your own Microsoft 365 environment. They are governed by the SharePoint permissions, retention and data policies you already run. Because the data sits in your tenant, it stays in the region your Microsoft 365 supports for your organisation.
What we hold
To run the service we keep a small amount of operational data: a record of your tenant, the state of the connections that let workflows fire, and technical logs. We are honest about that rather than claiming a blanket "we store nothing". Your business records are not in it.
Why this is worth caring about
If a vendor centralises everyone's compliance data, a breach at the vendor is a breach of yours. When the records never leave your tenant, that risk is simply not there to manage. And if you ever stop using us, there is no data to migrate back, because it was always in place.
Want the specifics for a security questionnaire? Call 1300 338 365 and we will walk through it.