Trust centre
Security, compliance and data protection for a UK virtual data room. Key product claims are registered, each tied to an automated test that is run before release. UK-hosted in London with primary data resident in the UK and encrypted backups in an EU region, AES-256 at rest, TLS 1.2+ in transit, DPA on request. Operated by 99 Developers Ltd (company number 17257492), registered in England and Wales. This page collects what we do, who our providers are, what we hold and who audits what.
What we operate
01
TOTP two-factor authentication with recovery codes; once enrolled, a password-only session cannot read your documents - enforced in Postgres row-level security, not in the app. How our controls work
02
per-tenant row-level security in Postgres, with a dedicated test suite run on changes before they are released. Row-level security explained
03
daily database backups by our database provider, and every stored document copied to encrypted storage in an EU region on a 30-minute schedule; the additional nightly offsite database copy is paused since 14 September 2026. Backups and recovery
04
HSTS with preload, Content-Security-Policy, frame-ancestors 'none', nosniff and referrer controls on every response. Check any response yourself
05
dependency updates proposed automatically every week; production dependencies audited against published security advisories. Our release gates
06
international transfers covered by Standard Contractual Clauses and the UK International Data Transfer Addendum. Read the DPA
07
a published vulnerability disclosure route at /.well-known/security.txt. security.txt
These are not marketing sentences that drift, and you do not have to take this page's word for anything the product does - point your AI assistant at our public MCP server and ask it directly; it answers from the source.
Certifications
We run on independently audited platforms: Supabase: SOC 2 Type II, ISO 27001; Cloudflare: SOC 2 Type II, ISO 27001/27018/27701, PCI DSS Level 1.
99 Data Rooms runs on SOC 2 Type II and ISO 27001 audited platforms from our infrastructure providers, Supabase and Cloudflare. A certification in 99 Developers Ltd's own name will be listed here with its certificate number and a link to the issuing register on the day it is issued. The full provider detail is on the security page.
Data protection
01
The full DPA text is published at /legal/dpa, including Standard Contractual Clauses and the UK International Data Transfer Addendum. A countersigned copy is available on request below.
02
Every third party that processes customer data is named in the sub-processor register, with what it does, where it runs, and how transfers are covered.
03
Privacy, cookies, acceptable use and terms are all public. Data export and account deletion are self-serve inside the product.
04
international transfers covered by Standard Contractual Clauses and the UK International Data Transfer Addendum. Primary data is resident in the UK (London); encrypted backups are held in an EU region. The detail is on the security page.
For your security review
Running vendor due diligence? Request a countersigned DPA, ask us to complete your security questionnaire, or request a written security overview. Tell us which you need and we reply within one business day.
If you would rather not ask: everything above is checkable without us. The response headers are on every request you have already made to this site, the disclosure route is at /.well-known/security.txt, the company is on the public register as 17257492, and our public MCP server will answer an AI assistant's questions about the product from source. A trust page you have to believe is not worth much.