Log inSubmit a tool

Is Afi UK GDPR compliant?

answer from its trust card · not checked yet

> short_answer

Afi handles customer data, so it acts as a supplier under UK GDPR. You’ll want a contract that covers processing, and to check where the data goes. The facts below are from its trust card.

No tool is “compliant” on its own; compliance depends on how you use it. This page shows the facts you need to decide.

The facts that matter for UK GDPR

Data to vendor: Copies of your mailboxes and files, encrypted (AES-256 at rest; you can bring your own key). Afi staff and contractors don’t have access to backup data.○ unclaimed
Data location: You choose: USA, Canada, Europe (Netherlands), Germany, Switzerland, the United Kingdom or Australia. Multi-geo tenants can map each geography to its own region.○ unclaimed
Data kept for: Immutable backup format; optional retention lock of about a month that no party, Afi included, can override.○ unclaimed
Certifications: Independently audited for SOC 2; CASA Tier 3. (ISO 27001 belongs to its host, Google Cloud.)○ unclaimed

What you still need to do

  1. Add it to your record of processing. Pre-filled entry
  2. Check your contract covers processing and any transfers abroad. DPIA starter
  3. Watch it, so you hear if any of this changes. Watch Afi