Data security and compliance

Tractivity's UK data residency sits in Microsoft Azure's UK region, with European, US and other regions available. Your stakeholder data stays in UK jurisdiction unless you choose otherwise. One clarification worth making, because it causes confusion in procurement: 'SRM' is used for two different categories. Stakeholder relationship management, which is what Tractivity is, and supplier relationship management, which is procurement software.

What data sovereignty means for stakeholder data

Data sovereignty means your data is subject to the laws of the country it's stored in. For stakeholder engagement that matters more than it does for most systems, because the records include political contacts, community objections, landowner correspondence and personal data gathered under consultation duties. If that sits outside the UK, an organisation can be asked to explain which legal regime governs it, and by whom it could be compelled.

This is particularly important for any team handling politically sensitive or community-facing engagement data, and for organisations under regulatory scrutiny from Ofgem, Ofwat or the Planning Inspectorate, or exposed to judicial review.

Where Tractivity's data is held

• Default region. Microsoft Azure's UK data centres. Full UK data residency, no configuration needed, so data stays under UK jurisdiction from day one.
• Alternative regions on request. The EEA, the United States and beyond, for organisations with their own jurisdictional requirements. The security controls and monitoring are identical wherever it's hosted.
• AI processing. AI Sentiment and AI Summarise run inside Tractivity's own Microsoft Azure environment in the UK and EEA. Customer data is never used to train models, and the features are off by default.
• Encryption. Advanced database encryption at rest, with a web application firewall, intrusion detection and OS file integrity monitoring in front of it.
• Accreditations. ISO 27001:2022, Cyber Essentials Plus, NHS DSPT (annually audited), Microsoft Azure SOC 2 hosting, and the G-Cloud framework, listed since G-Cloud 11 in 2019 across five successive frameworks under the Government Commercial Agency (formerly the Crown Commercial Service).
• Testing and monitoring. Annual independent penetration testing by a CREST-approved organisation, 24/7/365 platform monitoring, and a documented business continuity and disaster recovery plan.
  
  

Why UK hosting keeps coming up in public sector procurement

Buyers in central government, the NHS and regulated utilities usually work through their own security assurance process before they get to features. Cyber Essentials Plus is required for many central government contracts. NHS bodies need the DSPT. G-Cloud listing removes the need for a separate tender. UK residency is the question sitting underneath all three, and it's easier to answer once than to caveat repeatedly. Tractivity has supported organisations including HM Treasury, the Welsh Government, and NHS trusts and integrated care boards on that basis for over 20 years.

Tractivity’s role-based permissions give administrators complete control over data access. Permissions can be configured at multiple levels, from specific projects and modules right down to confidentiality controls on individual records, ensuring users only see what they are authorised to see.

This is essential for organisations working with third-party contractors, multi-agency partnerships, or cross-departmental teams where confidentiality requirements differ across projects. You maintain full control without compromising collaboration.

Tractivity systems are upgraded on a regular basis, informed by customer feedback and developments from our expert team. Major feature releases happen every three to four months, with security patches and smaller updates deployed in between to ensure your system remains protected against emerging threats.

All releases are completed outside of working hours, typically after 7pm, and clients are always informed in advance of any scheduled maintenance.