Built for procurement,
not for marketing.

01 · Jurisdiction

Data lives where UK/EU law applies.

• Hosting: OVHcloud bare metal, Roubaix data centre, France. EU jurisdiction. Not subject to the US CLOUD Act.
• Backups: primary on-host (restic) and OVH Object Storage (S3-compatible, EU). Disaster-recovery mirror at Hetzner, EU jurisdiction. Immutable copy at a second OVH region via Veeam (14-day Object Lock).
• Controller: 79th Unit Limited, UK CRN 17133814, ICO registration 00013660448, D-U-N-S 234717170, registered office 71-75 Shelton Street, London WC2H 9JQ.
• UK GDPR by default; EU GDPR aligned. Both apply because the controller is UK and the processor is in France.

02 · Infrastructure

Single-server discipline. Documented exit ramps.

• Compute: single OVH bare-metal host, Docker Compose orchestration. Multi-node only when a real customer requires it (S6 rule).
• Network: public ports 443 (Nginx + WAF) and WireGuard only. All other services bound to internal Docker networks. SSH is not publicly reachable: it is locked to the WireGuard tunnel.
• TLS: Let's Encrypt with automatic renewal. Strong cipher suites only.
• Egress: dedicated egress proxy for outbound collection. Tor egress available for declared open-source collection where source IP must not be the platform's own.
• Monitoring: external Uptime Kuma at Hetzner (independent host) so an outage of the primary host does not also take down the watcher.

03 · Cryptography

Signing keys are the differentiator.

• Dossier signing: ECDSA P-256 (NIST P-256, secp256r1) signatures on every signed envelope. Rust core engine handles signing.
• Public verifier keys: served from the verify subdomain at verify.clearsky.79thunit.co.uk/.well-known/clearsky-verifier-keys.json. Pin once, verify offline forever.
• Symmetric encryption: AES-256-GCM where applicable in cs-core. Keys never leave the server unless wrapped.
• Database at rest: PostgreSQL with the pgcrypto extension. Special-category fields are encrypted at the column level: sensitive case notes, medical conditions, medication, mental-health and self-harm risk, and financial access. Those stay ciphertext in the table, in any dump, and in every backup. The host filesystem is not full-disk encrypted; the NVMe pair is RAID1 for redundancy, not confidentiality. Backups are separately encrypted by restic before they leave the server.
• Secrets: Docker secrets and environment-variable injection at boot; not committed to source control. Rotation pathway documented.

04 · Auth, RBAC, and the audit log

Identity is Keycloak. Audit is append-only.

• Identity provider: Keycloak, self-hosted, clearsky realm. SSO via OIDC. SAML available for enterprise tenants.
• Roles: tier-scoped at the data path, not at the UI. CHILD-ANALYST role gate is mandatory for any under-18 biometric work (S14 rule).
• Audit log: append-only at the database layer. UPDATE and DELETE are blocked by a database rule, not a code convention. Names are never stored: only object UUIDs reach the log.
• Audit access: Analyst tier and above can read their own actions. Compliance role can read across the tenant. The audit log is queryable, not narrative.
• Proportionality gate: sensitive collection (defined per worker) requires a 7-criterion check before the worker will execute. The check issues a time-limited authorisation token. Without the token, the worker refuses.

05 · Sub-processors

Three named processors. All under DPA.

Anthropic is the single non-EU processor and is opt-in per analyst per route. No personal data leaves the EU on default routes. Stripe receives only what it needs to charge the subscription; card data never reaches CLEARSKY.

06 · Backup & DR

Three independent copies. One immutable.

• Primary: restic daily at 02:00 UTC, encrypted backup to OVH Object Storage (S3-compatible).
• DR mirror: Hetzner, EU jurisdiction. Independent provider so a single-vendor incident does not take both copies.
• Immutable copy: Veeam to a second OVH region with 14-day Object Lock. Cannot be deleted or overwritten within the lock window, by design.
• Git-bundle archive: 13-bundle archive at /opt/clearsky/git-backups/ for source-of-truth code recovery independent of GitHub availability.
• RPO: 24 hours. RTO: 4 hours to a working DR mirror. Both targets and the next steps to tighten them are tracked in the deployment plan.

07 · Subject rights

UK GDPR served by default, not as an afterthought.

• Article 15 (access): subjects request a Receipt of Evidence at the public portal, verify by OTP, and download a signed receipt built from the same audit log analysts write to.
• Field-level redaction reasoning: the receipt explains which fields were withheld and under which lawful basis. No black boxes.
• Article 16 (rectification), 17 (erasure where lawful), 18 (restriction), 21 (objection): exercised by emailing legal@79thunit.com, or through the portal appeal route below. We respond, or route the request to the controller, within one calendar month of receipt, as UK GDPR Article 12(3) requires. Where the data sits in a customer's investigation and the customer is the controller, the request is directed to them and 79th Unit assists as their processor. ICO escalation route printed on the appeal page.
• Subject appeal: if a redaction reasoning is wrong or the receipt missed data, the subject lodges an appeal at /subject_portal/appeal.html. Compliance reviews within 14 days.
• Source of truth: the privacy notice states what is held, on what lawful basis, and for how long.

08 · Vulnerability disclosure

Coordinated disclosure, no bounty yet.

• Report: email security@79thunit.com. PGP key on request.
• Acknowledgement: 2 working days.
• Triage: 5 working days for severity assignment.
• Fix windows: Critical 7 days, High 14 days, Medium 30 days, Low 90 days.
• Public credit: on request, in the changelog, after the fix has shipped.
• Bounty: not formally established. Bounty programme on the roadmap once the customer roster supports it.

09 · Incident response

72-hour notification, written into the schema.

• Detection: external uptime monitoring (Hetzner Kuma), database audit log anomalies, application error rate alerts.
• Triage: on-call founder receives the page. CSO function for tenants with a CSO is looped on tenant-impacting events.
• Customer notification: within 72 hours of confirmed incident affecting customer data, per UK GDPR Article 33 obligations on the controller. We notify on the controller's behalf where the contract delegates that step.
• ICO notification: within 72 hours of becoming aware of a personal-data breach likely to result in risk to subjects.
• Post-incident: signed After-Action Review (AAR) published to the public AAR registry where the incident does not require continued confidentiality.

10 · Certifications and roadmap

What we have, what we are working towards.

• ICO registration: in force, 00013660448.
• UK GDPR posture: built into the data model and exposed via the subject portal. The architecture is the compliance evidence.
• EU AI Act Article 5: prohibited practices blocked at form-schema level (S12 rule: doctrine compiled to schema).
• ISO 27001: not certified yet. Controls aligned with the standard; certification on the roadmap once the customer roster supports the audit cost.
• SOC 2: not certified yet. We do not market on US procurement standards because we are a UK controller; SOC 2 is on the long-list once a US enterprise customer requires it.
• Cyber Essentials Plus: in scope for FY26-27. Tracked in the dependency and infra audit cycle.

Contact

Procurement, DPO, security review.

Email compliance@79thunit.com for DPA, DPIA support, security questionnaires, sub-processor audits, or pen-test scoping. The same address handles ICO referrals and subject-rights escalations. Expect a working-day reply.