# FAQ > Frequently asked security and compliance questions about GoSmarter - data residency, AI, encryption, and access control. > > **URL:** https://www.gosmarter.ai/docs/faq/ **Date:** 0001-01-01 ## Frequently asked questions ### Data residency **Where is my data stored?** Core persistent customer data is hosted in Azure UK regions. See [Data Residency](../data-residency/). **Can I choose a different region?** GoSmarter follows a standard hosted model. Region options can be discussed as part of enterprise scoping. **Does any data leave the UK?** Some supporting processing may use EU regions where required by platform capability. Two sub-processors are the exception to UK/EU-only: Clerk (identity/authentication) and Stripe (billing) both transfer data to the United States under Standard Contractual Clauses and/or the Data Privacy Framework. See [Data Residency](../data-residency/) for detail. **Is my data subject to US law / the CLOUD Act?** GoSmarter is delivered on Microsoft Azure under Microsoft's contractual and compliance framework. Data residency and transfer controls are documented in [Data Residency](../data-residency/). ### AI and document processing **Does GoSmarter use AI?** Yes. AI is used for defined document-processing tasks. Non-AI algorithmic processing is also used where appropriate. See [AI Security](../ai-security/). **Is my data used to train AI models?** Not by Microsoft — they contractually commit that your data is not used to train, retrain, or improve their AI models (see [Microsoft's data privacy commitments](https://learn.microsoft.com/en-us/legal/cognitive-services/openai/data-privacy)). GoSmarter does use uploaded documents to continuously improve our own classification and extraction models; this data is never shared with Microsoft, other AI providers, or other customers. See [AI Security](../ai-security/) for the full explanation. No opt-out from this is currently available. **What AI services does GoSmarter use?** GoSmarter uses Microsoft Azure AI services appropriate to the workload. Service-level and regional details can be shared under NDA during a security review. **Does the optimisation solver use AI?** No. The cutting optimisation service is a pure algorithmic solver using heuristic and genetic algorithm techniques. It makes no external AI or API calls. ### Authentication and access **How do users sign in?** Via GoSmarter's Clerk identity platform. See [Access Control](../access-control/) for supported sign-in methods. **Does GoSmarter support MFA?** Yes, via an authenticator app or backup codes. It's opt-in per user and not currently required at sign-in or sign-up. See [Access Control](../access-control/). **Can a user in Company A see Company B's data?** No. Every API request validates the authenticated user's company membership against a dedicated database record. Requests for companies the user doesn't belong to are rejected. ### Encryption **Is data encrypted at rest?** Yes. AES-256 encryption on all storage (Azure SQL with TDE, Blob Storage with SSE, Key Vault). **Is data encrypted in transit?** Yes. TLS 1.2 minimum enforced on all services. HTTP connections are rejected. **Can I bring my own encryption keys?** Not currently. All encryption uses platform-managed keys. Customer-managed keys (BYOK/CMK) are not available. ### Infrastructure **Do you use shared or dedicated infrastructure?** GoSmarter runs on managed Azure platform services with isolation controls between workloads. **Is there a public status page?** Service status and incident communications are handled through customer support and account channels. **What is your uptime SLA?** Availability commitments are provided contractually based on your service agreement. ### Billing and subscriptions **How does pricing work?** GoSmarter uses tiered plans (Starter, Workshop, Production, Scale), each with a monthly allowance of AI processing credits used for mill certificate classification and extraction. You can start on a free trial without a card. **Can I try GoSmarter before paying?** Yes. A free trial is available with no card required upfront. **What happens if I use more AI processing than my plan allows?** You can purchase additional credit top-ups on top of your plan's monthly allowance. **Can I change or cancel my plan?** Yes, self-service. Upgrades take effect immediately; downgrades and cancellations are scheduled for the end of the current billing cycle so you keep what you've already paid for. **Where do I manage payment methods and invoices?** Through the self-serve billing portal, powered by our billing sub-processor Stripe. **Does GoSmarter store my card details?** No. Payment instruments are collected and stored directly by Stripe. See [Access Control](../access-control/) and [Privacy](../privacy/) for how Stripe is used as a sub-processor. ### Compliance **Do you have SOC 2 Type II?** GoSmarter runs on Azure, which maintains SOC 2 Type II attestation for relevant platform services. Azure reports are available via the [Microsoft Service Trust Portal](https://servicetrust.microsoft.com/). **Do you have ISO 27001?** Azure maintains ISO 27001 certification for relevant platform services. See [Certifications](../certifications/). **Do you conduct penetration testing?** Security testing is performed as part of our security programme. High-level outcomes and evidence can be shared under NDA where appropriate. **Can I get a copy of your DPA?** Yes. DPA information is available on request. **Can we get detailed architecture and control evidence?** Yes. Detailed technical documentation and assurance artefacts are available under mutual NDA. ### Still have questions? [Email us](mailto:support@gosmarter.ai), [contact us online](https://gosmarter.ai/contact), or [book a compliance call](https://calendly.com/gosmarter-demo) to request the NDA pack.