Composure holds your customers’ contact details and the facts of their incidents. Here is where that data lives, how it is protected, and what we commit to in writing.
Your data is stored in the UK. Where any supplier processes it elsewhere, we say so.
Stored in the UK (London). Email delivery runs in the EU (Ireland). AI drafting, text messages and WhatsApp messages are processed in the United States under UK transfer safeguards. Every supplier, what it handles and where is on our sub-processors page.
Encrypted at rest with AES-256 by our hosting provider (Supabase, London), and in transit with TLS. Every connection uses HTTPS. Backed up automatically every day; backups are kept for 7 days.
Admins must sign in with an authenticator app, and the server enforces it, not just the browser. You can require it for all your staff, and for a customer’s portal contacts.
Your team can sign in with their Microsoft accounts, so your own Microsoft security policies, including multi-factor and Conditional Access, apply. People can be added and removed automatically from your Microsoft groups.
Connecting HaloPSA or Microsoft Entra ID asks only for read access, and our setup guides show you how to grant exactly that. The credentials you give us are stored encrypted.
Every MSP’s data is separated inside the database itself, not just hidden by the app. One MSP can’t read another’s data, even if a screen had a bug, and a customer’s portal contacts see only their own organisation.
People reach only the data and actions their roles allow, and can hold several roles. Every rule is enforced in the app and again in the database.
If our support team needs to see your account, access is time-limited and recorded, and your admins can see it in the app.
Who sent each communication, to whom, and who approved it is recorded with the time on each incident and report. Privileged actions, such as password and two-factor resets and support access, are recorded too.
The AI drafts. A person on your team decides what your customers receive.
Every AI-drafted update, maintenance notice and RCA waits for a person to approve it before it is sent. Two automatic emails are the exception: “Service restored” (our fixed wording, which you can skip) and the final “Resolved” email (your own template), both lightly polished by AI and checked so no facts change.
The AI is told to keep hostnames, blame and speculation out of customer updates. On Communicate, each RCA is also scored by a separate AI reviewer, and wording that carries liability risk needs executive sign-off.
Our AI provider does not train on the incident details we send it, and deletes them within 30 days.
What we commit to is in our Data Processing Agreement, under UK GDPR.
Our DPA is part of the agreement you accept at sign-up. We’ll countersign a copy on request.
We give 30 days’ notice before adding a sub-processor, by email to your admins, and you can object.
Your admins can find, correct, export and delete contacts and users in the app.
How long we keep each kind of data is set out in our Privacy Notice and DPA.
We’ll send our security overview, complete your security questionnaire and countersign our DPA. To report a vulnerability, email the same address.
Composure247