Guv
Join the waitlist

Trust

Where your data lives, and who touches it.

If you build for care, health, education, legal or the public sector, someone will ask you where the data is and who can see it. Here are straight answers you can paste into your own risk assessment.

Data location

London, United Kingdom

Region lon1 · residency uk-only by default

  • Running servicesLondon, UK
  • Databases and volumesLondon, UK
  • BackupsA second UK provider
  • Logs and metricsLondon, UK
  • Build cache and imagesLondon, UK

Where your data lives

Guv has one region, London. With the default residency setting, uk-only, everything your project stores stays in the UK: your running services, databases, volumes, logs, metrics and backups. Backups go to a second, independent UK provider.

Some customers want a copy outside the UK for disaster recovery. A project can opt in to uk-eu residency, which also allows encrypted backups in France. Nothing leaves the UK unless you choose this, project by project, in guv.yaml or the dashboard.

UK-hosted, not US-owned

We want to be precise, because this matters to people who ask. Guv runs on servers rented from OVHcloud UK, in a London data centre. OVHcloud is a French company. So Guv is UK-hosted and not US-owned; we do not claim it is UK-owned infrastructure.

Some services we use are American, such as Stripe for payments and the provider of the AI models behind our support. We list every one of them below, with what they receive. None of them hosts your application data.

Who is responsible for what

Under UK GDPR, Guv plays two roles:

RoleFor which data
ControllerYour account, billing, support conversations, marketing preferences, and security logs about how you use Guv.
ProcessorEverything you deploy and store: your databases, files, logs and secrets. We act only on your instructions and do not inspect it.

Data processing agreement

Our UK GDPR Article 28 data processing agreement is part of our terms, so every customer has one without asking. In summary, we commit to:

  • process your data only on your documented instructions;
  • keep it confidential, and protect it with the measures described on our security page;
  • give you 30 days' notice before adding or replacing a sub-processor, so you can object;
  • tell you about a personal data breach affecting your data within 24 to 48 hours;
  • help you respond to data subject requests and carry out impact assessments;
  • delete or return your data when you leave, and destroy the encryption keys so copies cannot be read;
  • support audits through our reports and compliance pack.

The agreement is governed by the law of England and Wales.

Sub-processors

These are the organisations that may process personal data on our behalf. We will update this list, with notice, before anything changes.

Sub-processorPurposeLocation
OVHcloud UKHosting: servers, storage and networkLondon, UK
Second UK backup providerEncrypted off-site backupsNamed here before public launchUK
OVHcloud (Gravelines)EU backupsOnly for projects that opt in to uk-eu residencyFrance, EU
StripePayments and invoicingBilling details only, never your app dataUS and Ireland
Email delivery providerAccount and alert emailsUK or EU provider preferredTo be confirmed
AI model providerAI support and operationsZero data retention, no training. See belowUS
DNS providersName resolution for our domainsTo be confirmed
Status page hostPublic service statusNo customer dataTo be confirmed

Transfers to US sub-processors are covered by the UK International Data Transfer Addendum (or the UK–US data bridge where the company is certified), with a transfer risk assessment for each.

AI and your data

Guv is run with the help of AI, so you deserve to know exactly what it sees. These are our rules:

  • Metadata first. Our operations AI works from platform measurements: CPU, memory, error rates, deploy events. It does not read your data to do its job.
  • Your logs only when you ask. The content of your logs goes to an AI model only when you press "Explain this", or during an incident, in which case a redacted excerpt is used and the access is logged.
  • Special-category data never goes to a third-party AI. For projects classified special-category, such as care records, anything touching your content is handled by a model on our own hardware, or diagnosed from metadata alone.
  • No retention, no training. Our AI provider contract requires zero data retention and no training on your data, under a data processing agreement.
  • You always know. AI-written answers are labelled as AI, and you can ask for a person at any time.

Decisions about you

Some decisions affect you directly: blocking a suspected fraud, quarantining a project, suspending an account. Automatic checks can take reversible steps, such as quarantine, to protect other customers. Suspending or closing an account is always a human decision. In every case you are told what happened and why, you can respond, and you can ask for a person to review it.

Law enforcement requests

We only disclose customer data when a valid UK legal process requires it. Every request is verified independently and signed off by a director; our AI never responds to anything claiming to be from the police. Where the law allows, we tell the customer first. We will publish a transparency report every year.

To report abuse hosted on Guv, email abuse@guv.dev. Phishing and malware are acted on within hours.

Certifications and frameworks

Guv is a new platform and we will not claim certificates we do not yet hold. This is our plan, in order, and we will update this page as each one lands.

Cyber Essentials

Planned

Before public launch

The UK government-backed baseline, including multi-factor authentication on every cloud service.

NCSC Cloud Security Principles

Planned

Public self-assessment

All 14 principles, including an honest account of how AI operates the platform.

Cyber Essentials Plus

Planned

After launch

The independently audited version.

DSPT evidence pack

In preparation

For care and NHS customers

Supplier evidence to support your Data Security and Protection Toolkit submission.

ISO/IEC 27001:2022

Planned

12 to 18 months after launch

A certified information security management system.

G-Cloud

Planned

After Cyber Essentials Plus and ISO 27001

Listing on the UK public sector cloud marketplace.

Documents

On request, we can send you:

  • Data processing agreement (UK GDPR Article 28)
  • Sub-processor list, with change history
  • Data location statement, signed
  • NCSC Cloud Security Principles self-assessment (when published)
  • DSPT supplier evidence pack (Business plan)

Email privacy@guv.dev. Business customers can also download them from the Compliance tab in the dashboard.