Data security and compliance in Ireland

Tractivity, the UK stakeholder relationship management platform, offers EEA hosting on Microsoft Azure for Irish organisations, so stakeholder records stay under EU jurisdiction and EU GDPR. Worth clarifying, because it causes confusion in procurement: ‘SRM’ covers two categories, stakeholder relationship management, which is what Tractivity is, and supplier relationship management, which is procurement software.

What data sovereignty means for stakeholder data

Data sovereignty means your data is subject to the laws of the country it’s stored in. For stakeholder engagement that matters more than it does for most systems, because the records include political contacts, community objections, landowner correspondence and personal data gathered under consultation duties. For an Irish public body, keeping that inside the EEA removes a question it would otherwise have to answer about which legal regime governs it.

This is particularly important for any team handling politically sensitive or community-facing engagement data, and for organisations under regulatory scrutiny from the Commission for Regulation of Utilities, An Bord Pleanála or the Environmental Protection Agency, or exposed to judicial review in Ireland.

Where Tractivity’s data is held

• EEA hosting. Available for Irish organisations and anyone under EU GDPR, on Microsoft Azure, keeping stakeholder data within the European Economic Area and under EU regulatory jurisdiction.
• Other regions. Microsoft Azure’s UK region is the platform default, with the United States and other regions available. The security controls and monitoring are identical wherever it’s hosted.
• AI processing. AI Sentiment and AI Summarise run inside Tractivity’s own Microsoft Azure environment in the UK and EEA. Customer data is never used to train models, and the features are off by default.
• Encryption. Advanced database encryption at rest, with a web application firewall, intrusion detection and OS file integrity monitoring in front of it.
• Accreditations. ISO 27001:2022 and Cyber Essentials Plus, plus Microsoft Azure SOC 2 hosting. For UK-facing work, Tractivity also holds the NHS DSPT, audited annually, and is listed on the G-Cloud framework under the Government Commercial Agency, formerly the Crown Commercial Service.
• Testing and monitoring. Annual independent penetration testing by a CREST-approved organisation, 24/7/365 platform monitoring, and a documented business continuity and disaster recovery plan.

Why data residency keeps coming up in public procurement

Public bodies, utilities and their consultants usually work through their own security assurance process before they get to features, and residency is the question underneath most of it: which jurisdiction holds the records, and who could compel them. ISO 27001:2022 answers how the platform is managed, EEA hosting answers where the data sits, and EU GDPR answers on what basis it’s processed. It’s easier to answer those once, in writing, than to caveat them through an evaluation.

Tractivity’s role-based permissions give administrators complete control over data access. Permissions can be configured at multiple levels, from specific projects and modules right down to confidentiality controls on ndividual records, ensuring users only see what they are authorised to see.

This is essential for organisations working with third-party contractors, multi-agency partnerships, or cross-departmental teams where confidentiality requirements differ across projects. You maintain full control without compromising collaboration.

Tractivity systems are upgraded on a regular basis, informed by customer feedback and developments from our expert team. Major feature releases happen every three to four months, with security patches and smaller updates deployed in between to ensure your system remains protected against emerging threats.

All releases are completed outside of working hours, typically after 7pm, and clients are always informed in advance of any scheduled maintenance.