At some point someone will ask you to justify putting employee records in a new system. It might be a works council, an auditor, a customer’s security questionnaire, or an employee who simply wants to know. This lesson gives you the answers, and is equally clear about the two places where the honest answer is a qualified one.

Where the data is, and who else is in it

Your HR and employee data is stored and processed in the EU, in Ireland. You get a dedicated single-tenant environment: your own databases and storage, not a shared database, with encryption keys created for your tenancy alone. For an SME being asked whether its employee data is mixed in with other companies’, that is a clear and useful answer.

Data is encrypted in transit with TLS 1.2 or better, and at rest with AES-256. By default C2 manages the encryption keys on your behalf, with annual rotation, and that requires nothing from you. If you would rather hold the key material yourself, tenant custody is available on request on any plan, as an optional extra priced on request: you generate the material on your own computer in a browser ceremony that takes about fifteen minutes, and C2 never sees it. Understand the trade before you choose it: holding your own keys means that if you lose both your key material and your export key, nothing can restore your data and C2 cannot recreate either. That is the price of the control, and the control is narrower than it first sounds: it means your data at rest cannot be read without your key material. It does not mean C2 cannot see your data at all, because the running service still processes it. The paragraph below on legal reach is the other half of this.

The agreement, and the sub-processors

The Data Processing Agreement is an Article 28 GDPR agreement under Dutch law, and it is accepted automatically when you sign your subscription — you do not need to sign a separate one unless your internal policy requires a countersigned copy. Its version history is published.

Four sub-processors are listed publicly: Amazon Web Services for compute, storage and databases, and separately for transactional email and for monitoring, all in Ireland; and Mistral AI in France as the default language model provider for the AI assistant. You get at least 30 days’ notice before that list changes, and 10 calendar days to object to a new one. If a security questionnaire asks who else touches your data, that register is where you start. Two things to add when you answer it: changes those providers make to their own sub-processors are passed on to you as soon as C2 is notified of them, and Frappe HelpDesk, which runs the support desk, is part of the product and hosted by C2 rather than being a separate sub-processor.

Retention, requests and breaches

Retention periods are set per data category. Candidate, helpdesk, CRM and internal support data are erased or anonymised automatically when their period ends; other categories are reported for review rather than deleted on a timer, so somebody still has to make the decision. That is exactly why you set periods per category in Lesson 2.

Data subject requests — an employee asking for their data, or asking for it to be corrected or erased — are yours to answer, not C2’s. You are the controller of your employees’ data; C2 processes it on your behalf. So the request goes to your own named contact, and C2’s data protection contact is who you approach if you need help fulfilling it. These requests carry legal deadlines, so route them immediately rather than investigating first, and make sure your people know who to send them to.

On breaches, the obligation runs both ways. C2 notifies you without undue delay and in any event within 24 hours of becoming aware of a personal data breach affecting your data, which exists so that you can meet your own 72-hour deadline to your regulator. Your side of that is knowing, now, who makes that report and who decides it is necessary.

Availability and recovery

99.5% monthly availability, measured around the clock, excluding announced maintenance. Daily backups with 30-day retention, restores rehearsed quarterly against a recovery target of at most one hour and a recovery point of at most 24 hours.

Two things to state accurately, not optimistically

These will come up, and getting them wrong in a questionnaire is worse than not knowing them.

C2 is not ISO 27001 certified. Certification is in preparation with an external partner and is targeted for the second quarter of 2027. Hosting is in ISO 27001 data centres, which is a claim about the data centres, not about C2. Internal security audits against OWASP ASVS Level 2 have been completed, and an independent penetration test is planned rather than done. Say that, rather than implying a certificate exists.

EU hosting is not the same as being beyond legal reach. C2 runs on AWS, a US-headquartered provider, in EU regions. C2 can decrypt your data during normal operation, because it operates the platform on your behalf. Tenant custody means you can end that at will; it does not mean access never existed. If a legal request for your data arrives, you are told wherever the law allows.

If you need to answer a questionnaire properly, work from the Trust Center rather than from memory. It is public, so you can send a reviewer there directly.